Zotero Word Processor Plugin Insecure

brian.holda · 2025-09-12T16:44:32+00:00

In the Zotero Word Processor Plugin Troubleshooting documentation (https://www.zotero.org/support/word_processor_plugin_troubleshooting), it says:

Under “Add-ins”, make sure that “Require Application Add-ins to be signed by Trusted Publisher” and “Disable all Application Add-ins” are unchecked.

The problem is that our institution does require application add-ins to be signed by trusted publisher, so this is NOT an option to uncheck this.

Can Zotero please have their Add-in signed by a Trusted Publisher so that we can use the MS Word Add-in without needing to uncheck "Require Application Add-ins to be signed by Trusted Publisher"?

dstillman · 2025-09-12T16:46:39+00:00

No, that's a misunderstanding. Those instructions are just troubleshooting steps to help figure out why the plugin might not be showing up on a given computer.

The plugin is digitally signed. It's your institution that would have to add the certificate's publisher (Corporation for Digital Scholarship, our parent organization) as a trusted publisher if they require plugins to come from trusted publishers.

brian.holda · 2025-09-12T18:45:45+00:00

Thanks for the quick reply. Months back I followed documentation for doing this exact thing and yet it still doesn't work.

Here's what I tried:

1. I opened Zotero.dotm in MS Word. Then Developer Ribbon > Visual Basic > Tools > Digital Signature > Detail > Details > Copy to File.

2. I then imported the .cer file to trusted publishers in Microsoft Management Console via windows + R > certmgr.msc > Trusted Publishers > Certificates > Action > All Tasks > Import...

https://s3.amazonaws.com/zotero.org/images/forums/u5226581/5vqynd7rwpsjff9nqchv.png

I can even see it in MS Word via Options > Trust Center > Trust Center Settings > Trusted Publishers.

Yet it still won't show up in Word. Is there something else I'm missing? (of note: when I added the certificate to trusted publishers I was able to get Zotero macros to show up, where they had been blocked previously, just not the actual Zotero Add-in)

dstillman · 2025-09-13T05:02:30+00:00

We can't help with configuring Word, sorry. We can only tell you that it's signed (as you've seen).

brian.holda · 2025-09-15T18:53:31+00:00

Thanks for the quick response. I have spoken with our IT, and they have the same problem I do: we've added Corporation for Digital Scholarship as a trusted publisher, but the Zotero add-in will still not show.

Is there any example of someone having the Zotero add-in show up AND having “Require Application Add-ins to be signed by Trusted Publisher” checked in MS Word? I haven't seen one online.

@dstillman - would you be willing to try to do this just on your own instance and send a screenshot?

Many thanks!

dstillman · 2025-09-15T18:57:29+00:00

Again, we can't help with Word — it's not our software, and we don't know anything about configuring enterprise policies. All we do is sign the add-in. You would have to ask Microsoft for help beyond that.

We do that know people have configured this correctly, but we don't know more than that.

There could also be some other policy that's blocking the plugin from loading.

brian.holda · 2025-09-15T20:55:23+00:00

OK, thanks @dstillman.
For clarity, when I right-click Zotero.dotm, and click "Digital Signatures", it is blank.

https://s3.amazonaws.com/zotero.org/images/forums/u5226581/87ygh3m6knqp28heu980.png

I only see the signature when opening in Word, then Developer Ribbon > Visual Basic > Tools > Digital Signature. Is that unique to our setup, or is that to be expected?

dstillman · 2025-09-15T21:02:41+00:00

Yes, that's expected. That's for a different kind of signature.

brian.holda · 2025-09-17T20:15:47+00:00

OK, thanks for all this. I see the Zotero macros and Word Add-ins shows that Zotero.dotm is currently loaded, but sadly no Ribbon :/

If anyone else has run into this and knows possible solutions, I'm all ears.

Related: is there any talk of Zotero adding their app to the Office Store? Right now Mendeley is there, so our institution is opting to use that as default, but if Zotero was there, I think we'd opt for Zotero as default.

dstillman · 2025-09-17T20:24:44+00:00

We've built a new plugin, using a new Office extension framework, that will be available via the Office store, but we're waiting on additional changes from Microsoft before we can release it.

(Mendeley Cite is there with thousands of 1-star reviews. We hold ourselves to a somewhat higher standard.)

brian.holda · 2025-09-17T20:39:33+00:00

That's great to hear! I know-- I really don't want to leave Zotero for Mendeley (or other citation tools). Is there any way we as consumers can alert Office to help them expedite what they're doing? We would bring a decent amount of instant users over here at our institution.