CVE-2026-84936

EmbedPress WordPress plugin before 4.6.4 lacks proper authorization on a public review-loading action. An unauthenticated attacker can repeatedly trigger billable Google Reviews API requests using the site's own configured API key and insert an unbounded number of attacker-controlled rows into th...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability

Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability discovered by RIA Labs in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...