CVE-2025-60099: Embed Any Document Stored XSS Vulnerability

CVE-2025-60099 Overview

CVE-2025-60099 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Embed Any Document plugin for WordPress, developed by awsm.in. The flaw affects all plugin versions up to and including 2.7.7. Attackers with low-privileged authenticated access can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. Because the injected script runs in the security context of the WordPress site, it can hijack sessions, redirect users, or perform actions on behalf of victims. The vulnerability requires user interaction and crosses a trust boundary, allowing the payload to affect visitors beyond the attacker's privilege level.

Critical Impact

Stored XSS enables attackers with contributor-level access to persist malicious scripts that execute against site administrators and visitors, leading to session theft, defacement, and account takeover.

Affected Products

• awsm.in Embed Any Document plugin for WordPress
• All versions from n/a through 2.7.7
• WordPress sites with the plugin installed and active

Discovery Timeline

• 2025-09-26 - CVE-2025-60099 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60099

Vulnerability Analysis

The Embed Any Document plugin allows WordPress users to embed documents such as PDFs, Word files, and spreadsheets into posts and pages. The plugin fails to properly neutralize user-supplied input during web page generation. An authenticated user with contributor-level privileges or higher can supply crafted input through plugin parameters that gets stored in the database and later rendered without adequate sanitization or output encoding.

When a victim loads a page containing the injected payload, the browser executes the attacker's JavaScript in the context of the WordPress origin. The scope-change component of the vulnerability indicates the impact extends beyond the vulnerable component to affect other users of the site. Successful exploitation can lead to session cookie theft, unauthorized administrative actions through CSRF chains, credential harvesting via injected forms, and redirection to attacker-controlled infrastructure.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Plugin code accepts user-controlled values through embed shortcode attributes or configuration fields and writes them into HTML output without applying context-aware escaping functions such as esc_attr(), esc_html(), or wp_kses(). This allows HTML and JavaScript metacharacters to break out of their intended context.

Attack Vector

An authenticated attacker with contributor or higher privileges creates or edits content that invokes the plugin. The attacker embeds a crafted payload within a supported plugin parameter. The malicious content is persisted in the WordPress database. When any user, including administrators, views the affected post or page, the browser parses and executes the injected script. See the Patchstack Security Vulnerability Analysis for the specific parameter details.

Detection Methods for CVE-2025-60099

Indicators of Compromise

• Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs stored within wp_posts content or plugin option tables
• Outbound requests from browser sessions to unfamiliar domains after loading pages that use the Embed Any Document shortcode
• Creation of unauthorized administrator accounts following visits by privileged users to affected pages
• Anomalous session activity or cookie usage from authenticated administrator sessions

Detection Strategies

• Audit posts and pages containing the [embeddoc] shortcode for suspicious HTML entities, encoded script fragments, or non-standard attribute values
• Review WordPress user roles for recently promoted or unfamiliar contributor and author accounts that could stage payloads
• Deploy a web application firewall with rules that inspect request bodies for XSS patterns targeting plugin endpoints
• Correlate content edits by low-privileged users with subsequent administrator session anomalies using centralized logging

Monitoring Recommendations

• Ingest WordPress access, authentication, and audit logs into a centralized analytics platform to detect suspicious post edits
• Enable Content Security Policy (CSP) reporting to surface script execution from unexpected sources
• Monitor plugin version inventory across managed WordPress deployments to identify hosts still running vulnerable releases

How to Mitigate CVE-2025-60099

Immediate Actions Required

• Identify all WordPress sites running Embed Any Document version 2.7.7 or earlier and prioritize them for remediation
• Restrict contributor, author, and editor role assignments to trusted users pending patch deployment
• Review recently created or edited posts using the plugin's shortcodes for injected payloads and remove malicious content
• Rotate administrator credentials and invalidate active sessions if injected scripts may have executed against privileged users

Patch Information

At the time of publication, review the Patchstack advisory for Embed Any Document for the fixed version and upgrade guidance. Update the plugin through the WordPress admin dashboard or by replacing the plugin directory with the patched release.

Workarounds

• Deactivate and remove the Embed Any Document plugin until a patched version is installed if immediate updates are not feasible
• Apply a web application firewall virtual patch that blocks XSS payloads targeting plugin shortcode parameters
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Limit low-privileged users from publishing content that renders on public pages until remediation is complete

# Example Content Security Policy header enforcing script source restrictions
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"