75 matches found
PT-2026-86359
🚨 CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbound...
CVE-2026-61961
CVE-2026-61961 concerns the WordPress plugin EmbedPress (versions
CVE-2026-10526
The EmbedPress WordPress plugin, in versions prior to 4.6.1 , is vulnerable to an unauthenticated blind Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows an...
CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
CVE-2026-10526
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
CVE-2026-48872
CVE-2026-48872 relates to the WordPress WordPress EmbedPress plugin (versions
CVE-2026-7796
The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping...
CVE-2026-7796
The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping...
CVE-2026-7796
Technical details (affected plugin version, root cause, exploit specifics) are not provided in the supplied documents; monitor for updates.
WordPress EmbedPress plugin <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Youtube Block vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Plugin EmbedPress versions = 3.9.14...
EUVD-2024-31836
Malicious code in bioql PyPI...
EUVD-2023-54153
Malicious code in bioql PyPI...
EUVD-2024-27092
Malicious code in bioql PyPI...
EUVD-2024-27635
Malicious code in bioql PyPI...
EUVD-2024-27417
Malicious code in bioql PyPI...
EUVD-2024-17309
Malicious code in bioql PyPI...
EUVD-2023-59178
Malicious code in bioql PyPI...
EUVD-2023-54154
Malicious code in bioql PyPI...