Description
Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
Published: 2026-10-10
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting (XSS)
Action: Immediate Patch
AI Analysis

Impact

WordPress Document Embedder plugin allows unauthenticated users to inject arbitrary script via vulnerable input handling, enabling attackers to execute code in the context of a site visitor. This could lead to cookie theft, session hijacking, defacement or arbitrary code execution on the client side. The vulnerability is classified as a moderate‑to‑high severity issue with a CVSS score of 7.1.

Affected Systems

The affected product is the WordPress Document Embedder plugin from bPlugins, versions 2.4.0 or earlier. Any WordPress installation that still runs these versions is vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact if exploited. Because the flaw is unauthenticated, any external user can trigger it by submitting crafted input through the plugin’s interface. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a mitigation or patch in place increases exposure. An attacker could easily craft a malicious link or embed code to exploit the vulnerability, resulting in client‑side compromise.

Generated by OpenCVE AI on October 10, 2026 at 21:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Document Embedder plugin to the latest version (greater than 2.4.0) provided by the vendor, which resolves the XSS flaw.
  • If updating the plugin is not immediately possible, disable or uninstall the plugin to remove the attack surface until a patch can be applied.
  • In parallel, implement a strict Content Security Policy (CSP) that disallows inline scripts on pages generated by the plugin, reducing the impact of any remaining XSS vectors.

Generated by OpenCVE AI on October 10, 2026 at 21:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
Title WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-11T11:42:58.866Z

Reserved: 2026-07-13T06:14:33.110Z

Link: CVE-2026-62037

cve-icon Vulnrichment

Updated: 2026-10-11T11:40:14.526Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T20:16:39.873

Modified: 2026-10-13T13:28:15.717

Link: CVE-2026-62037

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T22:00:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')