PLUGIN SECURITY
Is Document Emberdder safe?
Embed PDF, Word, Excel & PowerPoint in WordPress. PDF viewer, 3D flipbook and document library with Gutenberg block & Elementor widget.
What this plugin does
- Slug:
document-emberdder - Author: bPlugins
- 9000+ active installs
- 98/100 rating (120 reviews on wordpress.org)
- 287217 all-time downloads
- On WordPress.org since 2019-09-10
document librarydocument viewerembed pdfpdf embedderpdf viewer
Maintenance status
- Latest known version: 2.2.1
- Last updated: 2026-11-08 5:36am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.1+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
7 known CVEs on file for Document Emberdder.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Document Embedder – let visitors read files without downloading [document-emberdder] <= 2.5.0 (unfixed) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.5.0 | 2.5.0 | 2026-10-10 | ⚠ update needed |
| CVE-2026-109370 | Document Embedder – let visitors read files without downloading [document-emberdder] < 2.4.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.4.1 | 2.4.1 | 2026-10-09 | ⚠ update needed |
| CVE-2026-16567 | Document Embedder – let visitors read files without downloading [document-emberdder] < 2.3.1 | Authorization Bypass Through User-Controlled Key | Unknown | < 2.3.1 | 2.3.1 | 2026-01-27 | ⚠ update needed |
| CVE-2025-12384 | Document Embedder – let visitors read files without downloading [document-emberdder] < 2.0.1 | Missing Authorization | High 8.6 | < 2.0.1 | 2.0.1 | 2025-11-04 | ✓ fixed in latest |
| CVE-2021-24775 | Document Embedder – let visitors read files without downloading [document-emberdder] < 1.7.6 | Exposure of Resource to Wrong Sphere | Medium 5.3 | < 1.7.6 | 1.7.6 | 2022-01-03 | ✓ fixed in latest |
| CVE-2021-24868 | Document Embedder – let visitors read files without downloading [document-emberdder] < 1.7.9 | Exposure of Resource to Wrong Sphere | Medium 4.3 | < 1.7.9 | 1.7.9 | 2022-01-03 | ✓ fixed in latest |
| — | Document Embedder – let visitors read files without downloading [document-emberdder] < 2.0.5 | — | Unknown | < 2.0.5 | 2.0.5 | 0000-00-00 | ✓ fixed in latest |
| CVE-2026-1389 | Document Embedder < 2.0.5 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion | — | Unknown | < 2.0.5 | 2.0.5 | — | ✓ fixed in latest |
+ 1 more known vulnerability
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-62037 | Document Embedder – let visitors read files without downloading <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting | — | Unknown | not specified | no fix on file | — | — |
How to fix it
Keep Document Emberdder updated — 2.2.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
1 of the vulnerabilities above has no fixed version on file — there's no update that resolves it. Consider deactivating this plugin or switching to one of the alternatives below.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files — 50000+ active installs — 84/100 (92)
- Document Library Lite — 4000+ active installs — 82/100 (12) — max PHP 8.4
- CatFolders Document Gallery & PDF Library — 3000+ active installs — 90/100 (15) — max PHP 8.4
- Document Viewer – let visitors view files right in the browser — 2000+ active installs — 94/100 (52)
- User Private Files – Secure File Sharing and Client Portal Plugin — 1000+ active installs — 88/100 (57) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.