CVE-2026-61961
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in EmbedPress versions up to and including 4.5.6.
Risk Assessment
An attacker can inject malicious script, potentially leading to data theft or session hijacking.
Recommendation
Update the EmbedPress plugin to the latest version that includes the security fix.
Other vulnerabilities in EmbedPress
See all- CVE-2026-10526Medium
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).
- CVE-2026-48872High
Versions of EmbedPress up to 4.5.2 are vulnerable to unauthorized access to sensitive data.
- CVE-2026-7796Medium
The EmbedPress plugin for WordPress up to version 4.5.3 is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute whenever a user visits the page.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.