CVE-2025-12885: Stored Script Injection Risk in WordPress Document Embedding

Vulnerability Overview

CVE ID: CVE-2025-12885
Vulnerability Type: Stored Cross-Site Scripting (XSS)
Severity: Medium
CVSS v3.1 Score: 6.4
Attack Complexity: Low
Privileges Required: Low (Contributor or higher)
User Interaction Required: Yes
Scope: Changed
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: None

CVE-2025-12885 is a stored cross-site scripting (XSS) vulnerability found in the WordPress plugin “Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files.”
The issue allows a logged-in user with Contributor-level permissions to inject malicious JavaScript into page content. Once saved, the malicious code executes automatically whenever any visitor views the affected page.

Because Contributor access is commonly granted on WordPress sites, this vulnerability represents a realistic attack scenario, especially on multi-author or content-driven websites.

Affected Versions and Patch Information

Vulnerable Versions

All versions up to and including 2.7.10

Fixed Version

Version 2.7.11 and later

The issue was resolved by strengthening input sanitization and output handling in the plugin’s document embedding logic. Administrators should treat any site running version 2.7.10 or lower as vulnerable.

What Caused the Vulnerability

The root of the problem lies in how the plugin sanitizes embedded document source data.

The plugin uses a function commonly referred to as sanitize_pdf_src, which processes HTML attributes used to embed documents (such as data-pdf-src).
This function relied on incomplete regular expression checks and insufficient filtering of HTML attributes.

Because of this:

JavaScript event attributes were not fully removed
Unsafe URL schemes could slip through validation
Embedded content was rendered without proper escaping

This created a situation where attacker-controlled input could be saved and later executed in the browser.

How the Vulnerability Is Exploited

Prerequisites

To exploit this issue, an attacker must:

Have a valid WordPress account
Be assigned the Contributor role or higher
Have access to create or edit posts using the plugin’s embed feature

No administrative access is required.

Exploitation Process

The attacker logs into WordPress as a Contributor
They create or edit a post
They embed a document using the plugin
A crafted value containing malicious JavaScript is inserted into the embed source field
The post is saved or submitted
The malicious code is stored in the WordPress database
Any user who views the page triggers the script in their browser

This is why the issue is classified as stored XSS — the payload remains active until the content is removed.

Why This Is Dangerous

Even though the attacker starts with limited privileges, the impact can be serious.

If an administrator views the infected page, the attacker can:

Steal authentication cookies
Hijack admin sessions
Perform actions as the administrator
Create new admin users
Modify site content
Install malicious plugins or backdoors

On sites with multiple contributors, this can lead to full site compromise.

Real-World Risk Scenarios

This vulnerability is particularly dangerous for:

News websites with freelance writers
Corporate blogs with many contributors
Educational websites with student or faculty authors
Community or membership portals
WordPress multisite environments

Any environment where Contributors can publish or submit content is at higher risk.

How to Detect If a Site Is Vulnerable

1. Plugin Version Check (Primary Method)

Check the installed plugin version:

Go to WordPress Admin → Plugins
Locate Embed Any Document
If the version is 2.7.10 or lower, the site is vulnerable

This is the most reliable detection method.

2. User Role Review

Sites are at increased risk if:

Multiple users have Contributor access
Guest author accounts exist
Old or inactive Contributor accounts are still enabled

Review all non-admin accounts carefully.

3. Content Inspection

Manually review posts that:

Contain embedded documents
Were authored by Contributors
Include unusual HTML attributes such as:
- onload=
- onclick=
- onerror=
- javascript: URLs
- Unexpected inline styles or data attributes

Any embedded document block with unexpected attributes should be treated as suspicious.

4. Database or File Search (Advanced)

Search post content for plugin-specific markers such as:

ead-document
data-pdf-src

Then review the surrounding HTML for unsafe attributes or scripts.

This should be done carefully, preferably on a staging copy of the database.

Is There a Payload to Test This?

There is no officially published exploit payload, and intentionally injecting XSS into production systems is not recommended.

Safe validation should rely on:

Plugin version confirmation
Review of sanitized output after updating
Manual inspection of stored content

Testing payloads should only be performed in isolated staging environments by qualified security staff.

How the Patch Fixes the Issue

The fixed version (2.7.11+) introduces multiple security improvements:

Removal of all JavaScript event attributes (on*)
Blocking of unsafe attributes like action and formaction
Strict validation of document source URLs
Allow-listing of only http:// and https:// schemes
Proper escaping of output before rendering
Sanitization of inline styles using WordPress core functions

These changes prevent malicious input from being stored or executed.

Prevention and Hardening Recommendations

Required Action

Immediately update the plugin to version 2.7.11 or later

This is the only complete fix.

Additional Hardening Measures

Restrict Contributor permissions where possible
Require editorial approval before publishing Contributor content
Remove unused or inactive user accounts
Enable a Web Application Firewall (WAF)
Apply a Content Security Policy (CSP) to limit script execution
Monitor for unexpected admin activity following content updates

These steps reduce exposure but do not replace patching.

Temporary Workarounds (If Immediate Update Is Not Possible)

If the plugin cannot be updated immediately:

Disable the plugin temporarily
Remove document embedding permissions from Contributors
Convert Contributor accounts to Author or Editor only if required
Block suspicious HTML attributes using a WAF
Increase monitoring of published content

These are temporary risk-reduction steps, not permanent solutions.

Signs of Possible Compromise

Administrators should investigate if they notice:

Unexpected admin logins after viewing posts
New admin users appearing without approval
Modified posts or pages
Embedded content redirecting users
JavaScript errors on pages with embedded documents

If compromise is suspected, reset credentials and audit recent content immediately.

Final Takeaway

CVE-2025-12885 is a moderate-severity vulnerability with high practical risk due to:

Low privilege requirements
Stored execution
Common usage of Contributor roles
Widespread plugin adoption

Any WordPress site using Embed Any Document version 2.7.10 or earlier should be considered vulnerable until updated.

Updating to version 2.7.11 or later is mandatory.