The vulnerability is an improper neutralization of input during web page generation that allows an attacker to store malicious scripts in the Embed Any Document plugin, resulting in a Stored XSS flaw. When a victim later views a page containing the stored payload, the injected script executes in the victim’s browser, potentially allowing cookie theft, session hijacking, site defacement, or other client‑side attacks. The weakness is a classic input validation failure documented as CWE‑79.

The flaw affects WordPress sites using the Embed Any Document plugin developed by awsm.in. All installations running version 2.7.7 or earlier are impacted. The plugin’s input handling for embedding documents is the source of the stored XSS vector.

The CVSS score of 6.5 indicates moderate severity; however, the EPSS score of less than 1% suggests a low likelihood of exploitation as of this analysis. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply malicious input through the plugin’s embed interface, which is typically accessible via the WordPress admin interface or exposed forms. If successful, the compromise would be limited to victim browsers, though widespread propagation is possible if infected content is shared.