CVE-2026-48872
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Versions of EmbedPress up to 4.5.2 are vulnerable to unauthorized access to sensitive data.
Risk Assessment
Organizations may be exposed to the disclosure of confidential information, potentially leading to privacy breaches and loss of customer trust.
Recommendation
It is recommended to update EmbedPress to the latest version to mitigate this vulnerability.
Other vulnerabilities in EmbedPress
See all- CVE-2026-61961High
Unauthenticated Cross Site Scripting (XSS) in EmbedPress versions up to and including 4.5.6.
- CVE-2026-10526Medium
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).
- CVE-2026-7796Medium
The EmbedPress plugin for WordPress up to version 4.5.3 is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute whenever a user visits the page.
Original NVD description (English source)
Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.