The EmbedPress WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'provider_name' parameter. This flaw allows authenticated users with Contributor or higher privileges to inject malicious scripts into pages, which execute when accessed by other users. The vulnerability arises from inadequate input validation and output escaping in versions up to 4.1.3. The CVSS 3.1 base score is 6.4 (medium severity), with network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts confidentiality and integrity with no impact on availability. No patch or official fix information is currently available, and no exploits are known in the wild.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to unauthorized actions or data disclosure when other users view the infected pages. The impact affects confidentiality and integrity but does not affect availability. Since the vulnerability requires authenticated access, it is limited to users with some level of trust on the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider monitoring for suspicious script injections. Avoid granting unnecessary privileges to reduce risk.