EmbedPress plugin for WordPress vulnerabilities

The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'embedpress_calendar' shortcode in versions up to and including 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes.

The EmbedPress plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to and including 3.8.2. This allows authenticated attackers with subscriber privileges or above to delete plugin settings.

The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key in the 'lock_content_form_handler' and 'display_password_form' functions in versions up to and including 3.7.3. This allows unauthenticated attackers to decrypt and view password protected content.