CVE-2026-18558: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in awsmin Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files

CVE-2026-18558 is a stored cross-site scripting vulnerability in the Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files WordPress plugin. The flaw exists in all versions up to and including 2.7.13 due to improper neutralization of input in the 'embeddoc' shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the injected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not affect availability but impacts confidentiality and integrity.

A patch is available for this vulnerability. Users should upgrade the Embed Any Document plugin to a version later than 2.7.13 where this issue is fixed. Since this is a WordPress plugin, updating via the official plugin repository or vendor channels is recommended to apply the official fix.