EmbedPress vulnerabilities
4 known CVE vulnerabilities in EmbedPress, translated and rated.
- CVE-2026-61961High
Unauthenticated Cross Site Scripting (XSS) in EmbedPress versions up to and including 4.5.6.
- CVE-2026-10526Medium
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).
- CVE-2026-48872High
Versions of EmbedPress up to 4.5.2 are vulnerable to unauthorized access to sensitive data.
- CVE-2026-7796Medium
The EmbedPress plugin for WordPress up to version 4.5.3 is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute whenever a user visits the page.