WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
embed-any-document
Published
2026-10-09
Title
Embed Any Document < 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
Slug
embed-articles
Published
2015-05-07
Title
Embed Articles <= 7.0.3 - CSRF & Stored XSS
Slug
embed-bokun
Published
2025-08-15
Title
Embed Bokun < 0.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
Slug
embed-calendly-scheduling
Published
2023-10-12
Title
Embed Calendly < 3.7 Contributor+ Stored XSS
Slug
embed-calendly-scheduling
Published
2026-02-24
Title
Embed Calendly < 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
embed-calendly-scheduling
Published
2026-04-18
Title
EMC Scheduling Manager < 4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode
Slug
embed-chessboard
Published
2025-04-04
Title
Embed Chessboard <= 3.08.00 - Contributor+ Stored XSS
Slug
embed-comment-images
Published
2017-08-17
Title
Embed Images in Comments <= 0.5 - Unauthenticated Stored XSS
Slug
embed-docs
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
embed-documents-shortcode
Published
2024-11-08
Title
Embed documents shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
embed-extended
Published
2025-04-01
Title
Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more <= 1.4.0 - Cross-Site Request Forgery
Slug
embed-form
Published
2024-04-18
Title
Jotform Online Forms < 1.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
embed-google-data-studio
Published
2025-09-11
Title
Embed Google Datastudio <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
embed-google-fonts
Published
2024-04-29
Title
Embed Google Fonts <= 3.1.0 - Missing Authorization
Slug
embed-google-map
Published
2025-02-13
Title
Embed Google Map <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
embed-google-photos
Published
2026-07-23
Title
Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
Slug
embed-google-photos-album-easily
Published
2024-04-22
Title
Embed Google Photos album < 2.2.1 - Authenticated (Contributor+) Server-Side Request Forgery
Slug
embed-google-photos-album-easily
Published
2026-08-11
Title
Embed Google Photos Album Easily <= 2.2.2 - Contributor+ Stored XSS via link Shortcode Attribute
Slug
embed-html5-game
Published
2026-04-21
Title
Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
Slug
embed-ispring
Published
2025-01-16
Title
iSpring Embedder <= 1.0 - Cross-Site Request Forgery to Arbitrary File Upload
Slug
embed-lottie-player
Published
2025-04-23
Title
Lottie Player < 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
Slug
embed-office-viewer
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
embed-office-viewer
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
embed-pdf-viewer
Published
2024-10-08
Title
Embed PDF Viewer < 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via height and width Parameters
Slug
embed-pdf-viewer
Published
2024-12-19
Title
Embed PDF Viewer < 2.4.0 - Authenticated (Editor+) Stored Cross-Site Scripting