406 matches found
WordPress EmbedPress plugin 4.4.9-4.6.6 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.4.9-4.6.6...
CVE-2026-85001: Improper Neutralization of Input During Web Page Generation
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...
PT-2026-103028
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...
CVE-2026-85002
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...
WordPress EmbedPress plugin < 4.6.7 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Dthangws in WordPress Plugin EmbedPress versions 4.6.7...
CVE-2026-85002 EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...
CVE-2026-85002 EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...
CVE-2026-85002
The EmbedPress WordPress plugin, in versions before 4.6.7 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape one of its block attributes before outputting it inside an HTML attribute, specifically identified in the Instagram Carousel Block Attributes . ...
EUVD-2026-87888
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...
CVE-2026-85002: Improper Neutralization of Input During Web Page Generation
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...
PT-2026-99493
Name of the Vulnerable Software and Affected Versions EmbedPress versions prior to 4.6.7 Description Insufficient escaping of a block attribute before it is output within an HTML attribute allows users with the contributor role or higher to execute Stored Cross-Site Scripting XSS attacks. This...
WordPress EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin <= 4.6.5 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin EmbedPress versions = 4.6.5...
CVE-2026-89330
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...
CVE-2026-89330 EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...
CVE-2026-89330 EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...
EUVD-2026-82733
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...
CVE-2026-89330
The EmbedPress WordPress plugin (PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos) is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the 'unique' parameter , impacting all versions up to and including 4.6.5 . The root cause is insufficient input sanitization and ...
CVE-2026-89330: Improper Neutralization of Input During Web Page Generation
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...
PT-2026-95274
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...
CVE-2026-84926
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...