CVE-2026-7796
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The EmbedPress plugin for WordPress up to version 4.5.3 is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute whenever a user visits the page.
Risk Assessment
An attacker can inject malicious scripts on a page that execute in visitors' browsers, potentially leading to session theft, content modification, or further attacks.
Recommendation
Update the plugin to the latest version that fixes this vulnerability. Restrict content editing privileges to trusted users only.
Other vulnerabilities in EmbedPress
See all- CVE-2026-85001Medium
The EmbedPress WordPress plugin before version 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
- CVE-2026-92727Medium
The EmbedPress plugin for WordPress up to version 4.6.6 is vulnerable to stored XSS via the 'slidesShow' block attribute. Authenticated attackers with contributor-level access can inject scripts that execute when a user visits the page.
- CVE-2026-85002Medium
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.
- CVE-2026-84936Medium
The EmbedPress WordPress plugin before version 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
- CVE-2026-84927Low
The EmbedPress WordPress plugin before version 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.
- CVE-2026-84926Low
The EmbedPress WordPress plugin before version 4.6.4 does not properly restrict access to one of its Google Reviews REST routes, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
- CVE-2026-61961High
Unauthenticated Cross Site Scripting (XSS) in EmbedPress versions up to and including 4.5.6.
- CVE-2026-10526Medium
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).
- CVE-2026-48872High
Versions of EmbedPress up to 4.5.2 are vulnerable to unauthorized access to sensitive data.
Original NVD description (English source)
The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
Vulnerability data from NVD (NIST) · CISA KEV · EPSS