384 matches found
EUVD-2026-71869
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...
CVE-2026-84927 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...
CVE-2026-84927
The EmbedPress WordPress plugin (versions 4.6.0-4.6.3 ) is vulnerable to a missing authorization check on one of its Google Reviews REST API routes. This flaw allows users with Contributor role privileges or higher to modify a site-wide store, which includes the ability to delete entries configur...
PT-2026-86359
šØ CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbound...
CVE-2026-84926: Exposure of Sensitive Information to an Unauthorized Actor
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...
PT-2026-86353
šØ CVE-2026-84926 The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress cor...
PT-2026-86354
šØ CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting...
CVE-2026-84927: Missing Authorization
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...
CVE-2026-84936: Improper Access Control
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...
WordPress EmbedPress plugin < 4.6.1 - Unauthenticated Blind SSRF vulnerability
Unauthenticated Blind SSRF vulnerability discovered by Ayush Srivastava in WordPress Plugin EmbedPress versions 4.6.1...
CVE-2026-61961
Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...
CVE-2026-61961
CVE-2026-61961 concerns the WordPress plugin EmbedPress (versions
CVE-2026-61961 WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...
CVE-2026-61961 WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...
CVE-2026-61961
Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...
EUVD-2026-53957
Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...
CVE-2026-61961: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...
CVE-2026-10526
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
EUVD-2026-52581
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...