Document Embedder – let visitors read files without downloading

Document Embedder – let visitors read files without downloading has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; 6 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.2, and the most serious one scores 8.6 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (29%). Other recurring categories include Authorization Bypass Through User-Controlled Key, Exposure Of Sensitive Information To An Unauthorized Actor.

6 of the records (86%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

6 independent researchers contributed these findings, most of them (2) reported by apple502j. Document Embedder – let visitors read files without downloading is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage86%
Open

1

Fixed

6

Get automatic notifications for all Document Embedder – let visitors read files without downloading vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-62037

Document Embedder – let visitors read files without downloading <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

7 records
Document Embedder – let visitors read files without downloading banner
Latestv2.5.0

Document Embedder – let visitors read files without downloading

bPlugins

Author

bPlugins

4.9(120)
98/100
Last Updated
2026-10-18 (10d ago)
Active Installs
9,000+
Downloads
280,380
Requires WP
6.5+
Requires PHP
7.1+
Tested up to
WP 7.1.3
Created
2019-09-10 (7y ago)

Embed PDF, Word, Excel and PowerPoint files in WordPress and let visitors read them right on the page. No downloads, no plugins for your visitors, no leaving your site. Document Embedder | Documentation | Pricing | Support | Demo Document Embedder is a PDF viewer, document viewer and document library for WordPress. Embed a PDF in any post or page, show Word documents, Excel spreadsheets and PowerPoint presentations inline, turn a PDF into a 3D flipbook, or build a searchable document library where visitors can view and download your files. Upload files from your computer or the Media Library, or paste a link to a file on Google Drive, Dropbox, Box or any public URL. Choose from four viewers: the Google viewer for Office files, a fast local PDF.js viewer, an interactive 3D FlipBook, or a slider. Every viewer is responsive on desktop, tablet and mobile. Add documents with the Gutenberg block, the dedicated Elementor widget, or a shortcode in any page builder. Built-in Insights show how many people viewed, read and downloaded each document. New in 2.5 Real 3D Flipbook: turn any PDF into a lit, page-curling 3D book, or pick a Soft or Flat page turn. Free. Document Insights: privacy-friendly PDF analytics for views, unique views, downloads, full-screen opens and time on screen. No cookies, no IP addresses. Box embeds: paste a Box shared link and the file opens in Box’s own viewer. Pro lets you browse your Box account from the block. AI Agent Access: let AI assistants such as Claude and ChatGPT read your documents and stats through the WordPress Abilities API and MCP. Library layouts and Elementor widget: Grid and List libraries (Table and Folder in Pro), plus a dedicated Elementor widget. Who uses Document Embedder Schools, teachers and online courses: share worksheets, syllabi, lecture slides and course notes. Works with TutorLMS. Businesses and intranets: publish policies, handbooks, forms and HR documents in one searchable library. Product and support teams: embed manuals, spec sheets, datasheets and price lists. Publishers, restaurants and agencies: show brochures, catalogues, magazines and menus as a page-turning flipbook. Nonprofits, councils and associations: post reports, meeting minutes, agendas and annual reports. Marketers: offer an ebook, whitepaper or case study as a lead magnet and collect an email before the download (Pro). Free Features PDF viewer and document embedder Embed PDF, Word, Excel, PowerPoint and 16+ file types: PDF, DOC, DOCX, XLS, XLSX, PPT, PPTX, Google Docs, images, code files and more. Four viewer engines, all free: Google viewer, local PDF.js viewer, 3D/2D FlipBook and slider. Real 3D PDF FlipBook: pick the page turn for each PDF flipbook: 3D (a lit WebGL book with curling pages), Soft (curling paper pages) or Flat (pages turn as rigid sheets). Browsers without WebGL, and phones unless you switch that off, show 3D as Soft, and visitors who ask their device for reduced motion get the Flat page turn. A flipbook with overlays (Pro) always uses the Flat page turn. Cloud links: paste a Google Drive, Dropbox or Box link, or any public file URL. Box shared links open in Box’s own viewer. Responsive embeds: set width and height separately for desktop, tablet and mobile. Live preview: see exactly what visitors will see while you edit. File name display: show the document title above the viewer. Download button: custom label, placed in the toolbar or below the document. Download behaviour: force a save dialog or open the file in a new tab, and set the filename visitors get. Download counter and download limit: show how many times a file was downloaded and cap downloads per visitor. Document library (file download page) Create a document library to list many files on one page, like a resource centre, download page or file archive. Library layouts: Grid and List: pick a layout when you create a library and switch at any time. Grid shows cards in columns; List shows one file per row with its description, type, size, date and author. Search, filter and sort: visitors can search by name, filter by file type and sort by name, date or size. View and download buttons: open any file in a preview popup or download it, with your own button text and colours. Load more: show a set number of documents and let visitors load the rest. Flexible uploads: add files from your computer, the Media Library or a URL. Descriptions written in the Media Library are used automatically. Full styling control: header, toolbar, card and row colours, borders, spacing, columns and corner radius. Responsive: built for phones, tablets and desktops. Up to 5 documents per library in the free version. Works with every editor and page builder Gutenberg block: the Document Embed and Document Library blocks, with every setting in the sidebar. Elementor widget: a dedicated Document Embedder widget that shows a single document or a whole library, with layout, size and style controls inside Elementor. Shortcodes: [doc id="123"] for a document and [document_library id="123"] for a library. They work in the Classic Editor, Divi, Bricks, WPBakery, Beaver Builder, Oxygen, Breakdance and any builder that supports shortcodes. Document post type: every document is saved as its own post, so you can manage and reuse it anywhere. Insights: document views and downloads See how your documents are used, from Document Embedder > Insights. Counting is anonymous: no IP address is stored and no cookies are set. You can switch it off, exclude roles (administrators by default), choose how long history is kept, and reset the data in Settings. Views and daily unique views: every viewer and file type (PDF in the Default/Google, Custom PDF, Flipbook and Slider viewers, Word, Excel and PowerPoint, images, video, Google Drive and Dropbox links), whether it is embedded with the block, the Saved Document block, the shortcode or the Elementor widget. A view counts once the document has been at least half on screen for a second. A lightbox document counts when its lightbox is opened. Time on screen: how long a document was visible in an open browser tab, for every viewer and file type. Downloads: counted when the file is delivered for saved documents and Media Library files. For a pasted external URL, counted when the download button is used. In a Document Library, counted when a visitor clicks Download. Full-screen use: the full-screen or open-in-new-tab button on the plugin toolbar of the Custom PDF viewer. Leads and conversion rate: leads for saved documents, compared with their views. List and editor: a “Views today” column on the Documents list and today’s figures in each document’s Download Stats box. The free version shows today’s figures. Every day is recorded from the moment you update, so upgrading to Pro reads back the history you already have: date ranges, a daily chart, top documents, top host pages and CSV export. AI Agent Access Ask an AI assistant about your documents. Document Embedder registers read-only abilities with the WordPress Abilities API, so AI assistants (Claude, ChatGPT and others, connected through the WordPress MCP Adapter) and REST API clients can read your data. They never change anything. document-embedder/list-documents: your documents with file type, viewer, shortcode, tags, downloads and leads. document-embedder/get-document: one document’s settings and the pages that embed it. document-embedder/get-download-stats: lifetime downloads and leads, and downloads in any date range. document-embedder/list-leads: download leads. Off until you switch on “Allow AI agents to read leads”. document-embedder/get-insights: today’s views, downloads, leads, conversion rate and time on screen, and today’s top documents. Requires WordPress 6.9 or newer, plus the WordPress MCP Adapter plugin for AI assistants. Only logged-in users with the right permissions can use the abilities. Switch them off in Settings > AI Agent Access. If you allow leads, lead names and emails are sent to the AI service you connect. IP addresses are never shared. Pro Features Upgrade to Document Embedder Pro for Insights history, advanced library layouts, lead capture, access control and cloud integrations. Insights history The free version shows today’s figures. Pro reads back every day recorded since you updated, straight from your own database. Date ranges: today, the last 7, 30 or 90 days, or any range you pick. Daily chart: views, downloads and leads day by day. Top documents and top host pages: see which files are read most and which pages they are read on. Per-document view: open any document to see its own figures and daily chart for the range you pick. CSV export: download the figures for any range. Advanced document library Table layout: a sortable table of documents. Visitors click a column header to sort, and you choose, reorder and hide columns (icon, name, type, size, date, author, folder, description and actions). Includes striped rows, page numbers and a card view on phones. Folder layout: organise files into folders and subfolders (up to 3 levels). Visitors browse with folder tiles or a sidebar tree, follow a breadcrumb, and search across every folder at once. Link to a folder: send visitors straight to one folder with a link. Group by folder: group the List layout by folder, or add a Folder column to the Table layout. Unlimited documents in every library. Lead capture and access control Email gate for downloads: ask for a name and email before a file is released, and turn any PDF into a lead magnet. Leads dashboard and CSV export: every submission is logged. Search it, filter it and export it to CSV in one click. View access control: show a document only to logged-in users or chosen user roles, with your own message for everyone else. Blocked visitors never receive the file link. Download access control: allow downloads only for logged-in users or specific roles. Secure document delivery: serve local PDFs through a signed, expiring link instead of exposing the file URL. Disable popout: stop visitors opening the document in a new window. More viewer features Interactive overlays: place notes, highlights, links and call-to-action buttons on any page of a PDF. They stay aligned at every zoom level. Flipbook controls: hard covers, page-turn sound, auto play with your own interval, single or double page mode, page-turn speed and the 3D book’s page edge colour. Lightbox popup: open a document in a popup from a button, an image or any element on the page. Toolbar themes: dark, light or fully custom toolbar colours. Advanced viewer settings: reader mode, thumbnail sidebar, full-screen button, starting page, default zoom and automatic loading of the latest file version. Loading indicator: show a spinner until the document has loaded. Cloud and performance Google Drive integration: browse and embed files straight from Google Drive. Dropbox integration: browse and embed files straight from Dropbox. Box integration: connect your Box account in Settings > Box API, then browse and embed Box files from the block. The public shared link is created for you, and a link you have restricted is never made public. Faster pages: lazy load documents until they scroll into view, render long PDFs page by page, and fall back automatically if the Google viewer does not respond. Priority support: direct help from the team that builds the plugin. Live Demo | Get Pro How to embed a PDF or document in WordPress With the block editor (Gutenberg) Open any post or page and click +. Search for Document Embed and add the block. Upload a file, pick one from the Media Library, or paste a Google Drive, Dropbox, Box or other link. Choose a viewer and adjust the size, toolbar and download button in the sidebar. Publish. With Elementor Edit the page with Elementor and search the widget panel for Document Embedder. Drag the widget onto the page. Choose Document and pick the file, then set the width, height and style. With a shortcode Go to Document Embedder > Add New Document, upload your file and save. Copy the shortcode, for example [doc id="123"]. Paste it into any post, page, widget or page builder. How to create a document library Go to Document Embedder > Document Library and click Add New Library. Choose a layout: Grid or List (Table and Folder in Pro). Add your files from your computer, the Media Library or a URL. Turn search, filters and sorting on or off, and style the header, toolbar and documents. Save, then add the library with the Document Library block, the Elementor widget or the [document_library id="123"] shortcode. Supported File Types (16+ Formats) Documents: .PDF, .DOC, .DOCX, .PAGES, .TXT, .XPS Spreadsheets: .XLS, .XLSX Presentations: .PPT, .PPTX Google Docs & Drive Files Images: .JPEG, .PNG, .GIF, .TIFF, .BMP Code Files: .HTML, .CSS, .JS, .PHP, .C, .CPP, .H, .HPP Adobe Files: .AI, .PSD 3D & Vector: .SVG, .EPS, .DXF Videos: WebM, MPEG4, MOV, AVI, FLV, WMV Fonts: .TTF Archives: .ZIP, .RAR Live Demo | Try The Pro User Feedback ⭐⭐⭐⭐⭐ nice plugin ❛❛it also works with the TutorLMS Plugin❜❜ –testexperten ⭐⭐⭐⭐⭐ Excellent plug-in with easy management ❛❛Many thanks to the developers for such a wonderful plugin. It really facilitates the administration of projects and optimizes the submission of content from external files. A great solution.❜❜ –o544r2987k ⭐⭐⭐⭐⭐ Great ❛❛A great plugin. I use it on every page.❜❜ –molomoro Liked this plugin? Hate it? Want a new feature? Send your feedback Check out our other WordPress Plugins- Html5 Video Player – Display videos as single and playlist in multiple skins. PDF Poster – Display/Embed PDF files with different styles. Html5 Audio Player – Listen audios with awesome visuals. StreamCast – Customizable radio player with different skins. 3D Viewer – Embed 3D models and 3D products with interaction. Advanced Post Block – Show posts and custom posts in different layouts.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C