Headline

CVE-2023-23707: WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability - Patchstack

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.

1 year ago

CVE

Open in Source

#xss #vulnerability #web #wordpress #pdf #aws

Solution

Update the WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin to the latest available version (at least 2.7.2).

n0paew discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.7.2.

No other known vulnerabilities for this pluginReport

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more