awsmin vulnerabilities

Products

• Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files 3

Latest awsmin CVEs

Newest publication first

1. CVE-2026-18558 Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode

   Published 2026-10-10

   Medium·CVSS 6.4 EPSS 0.15%

   The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versions up to, and including, 2.7.13 due to insufficient input sanitization and output escaping. This makes...

2. CVE-2025-12885 Embed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

   Published 2025-12-18

   Medium·CVSS 6.4 EPSS 0.26%

   The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output esc...

3. CVE-2025-1043 Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode

   Published 2025-02-20

   Medium·CVSS 6.4 EPSS 0.30%

   The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.5 via the 'embeddoc' shortcode. This makes it possible for authenticated attackers, with Contributor-le...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.