Security Alert Summary
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability via a regex bypass in the sanitize_pdf_src function. Authenticated users with Contributor-level access and above can inject scripts that execute when an affected page is viewed.
CVE Details
- CVE ID: CVE-2025-12885
- Affected plugin / component: Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress
- Affected versions: All versions up to and including 2.7.10
- Published: December 18, 2025 at 03:15:45 AM UTC
- Last modified: December 18, 2025 at 03:07:42 PM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires an authenticated user with Contributor-level access or higher (CVSS privilegesRequired: LOW). No user interaction is required for the injected scripts to execute (CVSS userInteraction: NONE).
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored Cross-Site Scripting (XSS) issue caused by insufficient input sanitization and output escaping in the plugin’s handling of document sources. Specifically, the sanitize_pdf_src function can be bypassed by crafted input that defeats its regular-expression based validation, allowing an authenticated attacker (Contributor or higher) to inject arbitrary web scripts into pages that display the affected document/embed.
These injected scripts are stored by the plugin and execute in the context of any user who views the infected page, which can lead to actions consistent with the CVSS impact values (limited confidentiality and integrity impacts).
How This Could Impact Your Website
In a typical small- or medium-sized WordPress site, multiple people may have different roles: a site owner (administrator), internal staff (editor or author), and external contributors or contractors (contributor). If a contributor or higher uploads or embeds a crafted document or uses a manipulated input field that reaches the vulnerable sanitize_pdf_src path, the injected script could run when other users view the page.
Practical consequences include increased risk of targeted phishing or social engineering against users who view the affected pages, and unauthorized actions that can alter page content or perform operations available to the viewing user’s session. The recorded CVSS impact indicates limited confidentiality and integrity effects rather than full site compromise, but any script execution in a user’s browser can be used to harvest information visible to that user or perform actions as that user within the limits of their privileges.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles and permissions, especially Contributor and other roles that allow content upload or embedding.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected content changes or uploads.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
