CVE-2023-4282

The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'adminpostremove' and 'removeprivatedata' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or...

EmbedPress < 3.8.3 - Subscriber+ Plugin Settings Delete

Description The plugin does not properly authorize access to its adminpostremove and removeprivatedata actions, allowing low privileged users such as subscribers to delete plugin settings...

PT-2023-28605

Name of the Vulnerable Software and Affected Versions EmbedPress plugin for WordPress versions up to, and including, 3.8.2 Description The issue is related to a missing capability check on the admin post remove and remove private data functions. This allows authenticated attackers with subscriber...