CVE-2026-89330

MediumCVSS 6.1

Published: 18/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The EmbedPress plugin for WordPress in all versions up to and including 4.6.5 is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute if they can trick a user into clicking a link. This is a regression: the esc_url() wrapper that remediated CVE-2023-5749 was removed in version 4.3.0 during a refactor.

Risk Assessment

Attackers can execute arbitrary JavaScript in a victim's browser, enabling session theft, redirects, or page content modification. This requires tricking a user into clicking a crafted link.

Recommendation

Update the EmbedPress plugin to a version later than 4.6.5. Until then, consider disabling the plugin or deploying WAF rules that filter the 'unique' parameter.

Other vulnerabilities in EmbedPress WordPress plugin

CVE-2026-85000Medium
The EmbedPress WordPress plugin before version 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.

Original NVD description (English source)

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is a regression: the esc_url() wrapper that remediated the equivalent CVE-2023-5749 in version 3.9.2 was removed in version 4.3.0 during a refactor that introduced the 'unique' parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS