EasyEMBED – Embed PDFs, Docs, Word, Excel, Powerpoint, Slides, & More
EasyEmbed lets you embed documents directly into your WordPress posts and pages using a simple shortcode. Supported document types include PDFs, Google Docs, Google Sheets, Google Slides, Word documents, Excel spreadsheets, and PowerPoint presentations. Features Embed PDFs, Google Docs, Google Sheets, Google Slides, Word, Excel, and PowerPoint files Simple [easyembed] shortcode with flexible attributes Zoom controls for spreadsheet embeds Fullscreen support Light and dark theme options Responsive design that works on all devices Optional download button for embedded documents External Services This plugin connects to external services in two situations: 1. EasyEmbed Dashboard (easyembed.io) When you configure a Dashboard URL in the plugin settings and use the id attribute in a shortcode, the plugin connects to the EasyEmbed service at easyembed.io. What data is sent and when: The embed ID and your API key are sent to retrieve the document URL and display settings each time a shortcode is rendered on a page. The embed’s public ID is sent to record a view count each time a visitor loads a page with a managed embed. Your API key is sent to retrieve your list of embeds in the WordPress admin panel. No data is sent to easyembed.io when using direct URL embeds (the url attribute), or when no Dashboard URL is configured in the plugin settings. EasyEmbed Terms of Service EasyEmbed Privacy Policy 2. Microsoft Office Online Viewer (view.officeapps.live.com) When embedding Word (.doc, .docx), Excel (.xls, .xlsx), or PowerPoint (.ppt, .pptx) files using a direct URL, the plugin constructs an iframe pointing to Microsoft’s free Office Online viewer service. What data is sent and when: The publicly accessible URL of the document file is passed as a query parameter to view.officeapps.live.com in the iframe src attribute, each time a visitor loads a page with that embed. The document URL is sent to Microsoft’s servers so their viewer can fetch and display the file. This service is provided by Microsoft. No personal user data is sent — only the document URL. Microsoft Terms of Service Microsoft Privacy Statement
Strands PDF Embed
PDF Embed renders PDFs directly in your pages using PDF.js: no plugins for the visitor, no Google Docs iframes, no third-party trackers. PDF.js is bundled inside the plugin and served from your own site, so no third-party requests are ever made. Built by Fren at Strands Services Ltd. Support: fren@strands.gg. Features Continuous vertical scroll across all pages, with lazy rendering via IntersectionObserver Page navigation, zoom, fit-to-width, download, and print controls (these toggle which buttons render in the toolbar; they’re a UI choice, not access control; see the Security section) Global sizing modes: Responsive, Fixed, or Fixed Aspect Ratio (A4, Letter, 16:9, 4:3, 1:1, or custom) Light, Dark, or Auto color mode (Auto follows the visitor’s OS/browser prefers-color-scheme) Per-mode color customization (with alpha/transparency support on the Page Shadow field), plus a safely-scoped Custom CSS field for power users Live preview on the settings page Editors: Gutenberg block, Classic Editor TinyMCE button, Enfold ALB element, Elementor widget, WPBakery element, and [pdf_embed] shortcode Media Library picker filtered to PDFs only Translation-ready (English + Hungarian included) Theme-overridable viewer template Shortcode [pdf_embed id="123" sizing="responsive" download="yes" navigation="yes" zoom="yes"] All attributes are optional except id. Per-embed attrs override the global defaults on the Sizing and Appearance tabs. Security Frontend visitors have no attack surface: no REST endpoints, no AJAX handlers, no form submissions. Shortcode attribute sanitizers reject any value outside strict whitelists (units, hex/rgba colors, W:H ratios). Attachment access is gated by current_user_can('read_post', $id); contributors cannot embed other users’ private PDFs. pdfjsLib.getDocument() is called with isEvalSupported: false to prevent font-based JS execution. All output is routed through WordPress’s escape functions (esc_html, esc_attr, esc_url, wp_kses, wp_print_inline_script_tag). The release pipeline includes a check that fails the build if a phpcs:ignore for the output-escaping sniff ever appears in shipped code. Canvas size is clamped to ~268M pixels per page. Page count is capped at 2000 per embed. Both prevent client-side DoS from hostile PDFs. PDF.js ships inside the plugin and loads only from your own domain; no third-party servers are contacted. Debug information (attempted mime, extension) is only emitted when WP_DEBUG is on. Content-Security-Policy: the plugin emits one inline (appearance CSS variables) and one inline (PDF.js loader). The script tag is rendered via wp_print_inline_script_tag(), so a CSP supplied through the wp_inline_script_attributes filter is applied automatically. On sites without wiring, strict CSP needs style-src 'unsafe-inline' and script-src 'unsafe-inline' for the viewer to boot. Toolbar toggles are UI affordances, not access control. The shortcode’s download, navigation, and zoom attributes (and the matching options in the editors) control which buttons appear in the viewer toolbar; they don’t restrict what the visitor’s browser can do once the page is rendered. PDF.js needs the entire PDF in the browser to display it, so the bytes are always reachable from the browser’s network/devtools panel by anyone who can see the page. The pdfEmbedGetInstance(container) JS handle also exposes the underlying viewer methods regardless of which buttons render. If you need to keep a PDF away from a viewer, gate the post behind WordPress’s permission system (private/draft, role-restricted, members-only plugin). Don’t rely on the toolbar toggles. Third-party libraries The plugin bundles minified copies of these libraries under assets/js/vendor/. Full un-minified source is available from each project’s repository at the pinned version listed below: PDF.js 5.7.284 (pdf.min.js, pdf.worker.min.js) — Apache 2.0 — https://github.com/mozilla/pdf.js/releases/tag/v5.7.284 wp-color-picker-alpha 3.0.4 (wp-color-picker-alpha.min.js) — GPL-2.0-or-later — https://github.com/kallookoo/wp-color-picker-alpha Phosphor Icons (inline SVG, Regular weight) — MIT — https://github.com/phosphor-icons/core The plugin’s own PHP, JS, and CSS is shipped as-is without minification so the deployed code is also the source.
