Embed PDF Viewer
Embed PDF Viewer has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Server-Side Request Forgery (SSRF).
Every one of the 3 issues recorded for Embed PDF Viewer has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Embed PDF Viewer is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-32349Embed PDF Viewer <= 2.4.7 - Authenticated (Contributor+) Server-Side Request Forgery
Read the full analysisVulnerability Records
Embed PDF Viewer
Author
Andy Fragen
Embed a PDF from the Media Library or elsewhere via oEmbed or as a block into an iframe tag. The URL only has to be world reachable link. Chrome uses Google Doc Viewer as Chrome seems to automatically rendered embedded JS in PDFs automatically. Uses Google Doc Viewer with mobile. Inspired by Embed PDF and RV Embed PDF. Many thanks to Alex Kirk for making Embed PDF Viewer compatible with the new block editor. Development on GitHub. Pull requests are welcome against the develop branch. Known Issues Occasionally Google Doc Viewer will not correctly load the PDF. Reloading the page should correct the issue, though this may need to be done several times.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C