Vulnerability · Published Mar 23, 2023 · Assigned by Patchstack

CVE-2023-23707WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)

Medium 5.9

In plain English

A medium-severity cross-site scripting in Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files from Awsm Innovations. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.4%top 67.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.

Affected products (as reported)

Vendor	Product	Versions
Awsm Innovations	Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files	n/a – through 2.7.1

Weakness: CWE-79, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

References

https://patchstack.com/database/vulnerability/embed-any-document/wordpress-embed-any-document-embed-pdf-word-powerpoint-and-excel-files-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry