The EmbedPress WordPress plugin, which enables embedding PDFs, YouTube videos, Google Docs, and other media, suffers from a stored XSS vulnerability (CWE-79) in its Google Calendar Widget Link feature. This vulnerability allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code due to improper neutralization of input during web page generation. The injected scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The issue affects all plugin versions up to 3.9.8. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impacts. No patch or vendor advisory is currently available.

An attacker with contributor-level or higher permissions can store malicious scripts in pages via the Google Calendar Widget Link. These scripts execute in the browsers of users who view the infected pages, potentially compromising user sessions or performing actions on behalf of users. The impact includes limited confidentiality and integrity loss but no availability impact. The vulnerability requires authenticated access and does not involve user interaction for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider disabling or removing the Google Calendar Widget Link feature if feasible. Monitor for plugin updates from wpdevteam addressing this vulnerability.