CVE-2026-12517

CVE-2026-12517 affects the Fediverse Embeds WordPress plugin prior to 1.5.8. The vulnerability is a Server-Side Request Forgery (SSRF) in the site-info endpoint, where an unauthenticated request can target internal/private-network URLs and return parsed page metadata. The gating nonce is exposed ...

EUVD-2026-42513

The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users the gating nonce is exposed on public pages carrying an embed to make the site request...