{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12885", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-07T17:24:29.931Z", "datePublished": "2025-12-18T01:51:13.164Z", "dateUpdated": "2026-04-08T17:32:02.980Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:02.980Z"}, "affected": [{"vendor": "awsmin", "product": "Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Embed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efbdf0f0-6b38-418c-b3fb-396f89ada34f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406443/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-10-30T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-19T16:40:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-17T13:41:06.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T14:47:04.381105Z", "id": "CVE-2025-12885", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T15:01:39.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12885", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T14:47:04.381105Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T14:47:06.491Z"}}], "cna": {"title": "Embed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "awsmin", "product": "Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-30T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-19T16:40:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-17T13:41:06.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efbdf0f0-6b38-418c-b3fb-396f89ada34f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406443/"}], "descriptions": [{"lang": "en", "value": "The Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:02.980Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12885", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:32:02.980Z", "dateReserved": "2025-11-07T17:24:29.931Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-18T01:51:13.164Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Embed Any Document \u2013 Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-12885", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-18T03:15:45.680", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3406443/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/efbdf0f0-6b38-418c-b3fb-396f89ada34f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:43:05.594103+00:00", "value": {"mitigation_remediation": ["Install the latest release of the Embed Any Document plugin (any version greater than 2.7.10).", "If an upgrade is not feasible immediately, revoke Contributor rights from users or limit the ability to embed documents entirely.", "As a short\u2011term fix, audit existing posts and pages for embedded documents that contain script tags and remove or cleanse them until the plugin is updated."], "summary": {"action": "Upgrade Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Affecting the AWSMin Embed Any Document WordPress plugin, all releases up to and including version 2.7.10. Users with Contributor permissions or above can exploit the flaw by editing or adding documents that contain injected scripts.", "description_and_impact": "The Embed Any Document plugin is susceptible to a stored cross\u2011site scripting flaw that arises from a regex bypass in the sanitize_pdf_src function. This weakness allows an attacker with Contributor level or higher to inject arbitrary JavaScript into embedded PDF, Word, PowerPoint or Excel files. Once injected, the malicious scripts run automatically when any user loads the affected page, potentially leading to session hijacking, defacement or the execution of unauthorized code.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low overall probability of exploitation at present. It is not listed in the CISA KEV catalog. The most likely attack vector involves legitimate users who possess Contributor privileges leveraging the editor interface to embed a malicious document. An attacker would need authenticated access to the WordPress site and the ability to modify content that includes embedded files. Successful exploitation would grant the attacker persistent code execution on browsers of any visitor who views the compromised page."}}}}, "created": "2025-12-18T09:55:30.302489+00:00", "updated": "2026-04-21T00:45:23.100935+00:00", "vendors": ["awsm", "awsm$PRODUCT$embed_any_document", "wordpress", "wordpress$PRODUCT$wordpress"]}