Document Embedder – let visitors read files without downloading

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Document Embedder – let visitors read files without downloading

Information

Software Type Plugin
Software Slug document-emberdder (view on wordpress.org)
Software Status Active
Software Author bplugins
Software Website documentembedder.com
Software Downloads 270,397
Software Active Installs 9,000
Software Record Last Updated October 10, 2026

5 Vulnerabilities

Submit a Vulnerability
Document Embedder – let visitors read files without downloading < 2.3.1 - Unauthenticated Arbitrary Document Download
7.5
CVE-2026-16567
Aug 28, 2026
Researcher: Vaibhav Narkhede
Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
4.3
CVE-2026-1389
Jan 27, 2026
Researcher: Itthidej Aramsri (Boeing777)
Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation
8.6
CVE-2025-12384
Nov 4, 2025
Researcher: NumeX
Document Embedder < 1.7.6 - Sensitive Data Exposure
5.3
CVE-2021-24775
Jan 3, 2022
Researcher: apple502j
Document Embedder <= 1.7.8 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure
4.3
CVE-2021-24868
Jan 3, 2022
Researcher: apple502j
Title Status CVE ID CVSS Researchers Date
Document Embedder – let visitors read files without downloading < 2.3.1 - Unauthenticated Arbitrary Document Download Patched CVE-2026-16567 7.5 Vaibhav Narkhede August 28, 2026
Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion Patched CVE-2026-1389 4.3 Itthidej Aramsri (Boeing777) January 27, 2026
Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation Patched CVE-2025-12384 8.6 NumeX November 4, 2025
Document Embedder < 1.7.6 - Sensitive Data Exposure Patched CVE-2021-24775 5.3 apple502j January 3, 2022
Document Embedder <= 1.7.8 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure Patched CVE-2021-24868 4.3 apple502j January 3, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation