The Embed Any Document plugin is susceptible to a stored cross‑site scripting flaw that arises from a regex bypass in the sanitize_pdf_src function. This weakness allows an attacker with Contributor level or higher to inject arbitrary JavaScript into embedded PDF, Word, PowerPoint or Excel files. Once injected, the malicious scripts run automatically when any user loads the affected page, potentially leading to session hijacking, defacement or the execution of unauthorized code.

Affecting the AWSMin Embed Any Document WordPress plugin, all releases up to and including version 2.7.10. Users with Contributor permissions or above can exploit the flaw by editing or adding documents that contain injected scripts.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low overall probability of exploitation at present. It is not listed in the CISA KEV catalog. The most likely attack vector involves legitimate users who possess Contributor privileges leveraging the editor interface to embed a malicious document. An attacker would need authenticated access to the WordPress site and the ability to modify content that includes embedded files. Successful exploitation would grant the attacker persistent code execution on browsers of any visitor who views the compromised page.