Known vulnerabilities in Embed PDF Viewer

Embed a PDF from the Media Library or elsewhere via oEmbed or as a block into an iframe tag.

3Reported vulnerabilities

6.4Highest CVSS score

2.5.1Latest version

20,000+Active installs

What to do now

Update Embed PDF Viewer to 2.4.8 or later. 3 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 12, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-9451	Medium 6.4	0.4%	0 to 2.4.4 (inclusive)	`2.4.5`	October 9, 2024
CVE-2026-32349	Medium 6.4	0.2%	2.4.7 and earlier	`2.4.8`	February 11, 2026
CVE-2024-56256	Medium 4.4	0.2%	2.3.1 and earlier	`2.4.0`	December 19, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.