The Embed Any Document plugin is vulnerable to stored cross‑site scripting, allowing an authenticated user with contributor privileges or higher to inject malicious scripts with the 'embeddoc' shortcode. The injected scripts are stored in the database and executed whenever a page containing the shortcode is rendered for any visitor, enabling cookie theft, session hijacking, defacement, or malware delivery to site users.

Any WordPress site running the Embed Any Document plugin version 2.7.13 or older is impacted. The flaw exists in all releases up to and including 2.7.13 and affects sites that embed PDFs, Word, PowerPoint, or Excel files via the shortcode.

The CVSS score of 6.4 indicates moderate severity; the exploit requires the attacker to be authenticated with contributor level access or higher but imposes no special network prerequisites. EPSS data is unavailable, so the exploitation probability is uncertain, and this issue is not listed in CISA KEV. An attacker can fully control the front‑end content and influence end users.