CVE-2026-84926: Exposure of Sensitive Information to an Unauthorized Actor

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...

PT-2026-86354

🚨 CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting...

PT-2026-86359

🚨 CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbound...

WordPress EmbedPress plugin < 4.6.1 - Unauthenticated Blind SSRF vulnerability

Unauthenticated Blind SSRF vulnerability discovered by Ayush Srivastava in WordPress Plugin EmbedPress versions 4.6.1...

CVE-2026-61961

Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...

CVE-2026-61961 WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...

EUVD-2026-53957

Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...

CVE-2026-61961

CVE-2026-61961 concerns the WordPress plugin EmbedPress (versions

CVE-2026-61961

Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...

CVE-2026-61961 WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...

CVE-2026-61961: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...

CVE-2026-10526

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

CVE-2026-10526

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

CVE-2026-10526

The EmbedPress WordPress plugin, in versions prior to 4.6.1 , is vulnerable to an unauthenticated blind Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows an...

CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

EUVD-2026-52581

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

PT-2026-67644

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

CVE-2026-10526: Server-Side Request Forgery (SSRF)

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin EmbedPress versions = 4.5.6...