bPlugins Document Embedder vulnerabilities

Latest bPlugins Document Embedder CVEs

Newest publication first

1. CVE-2026-62037 WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-10

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

2. CVE-2021-24868 Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure

   Published 2022-02-01

   Medium·CVSS 4.3 EPSS 0.94%

   The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.

3. CVE-2021-24775 Document Embedder < 1.7.5 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure

   Published 2022-02-01

   Medium·CVSS 5.3 EPSS 1.3%

   The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.