bPlugins Document Embedder – let visitors read files without downloading

• CVE-2026-109370 Medium 6.4 Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute 0.2%