The EmbedPress WordPress plugin allows embedding various media types but suffers from a stored XSS vulnerability due to improper neutralization of user-supplied input in the 'embedpress_pro_twitch_theme' attribute. This flaw permits authenticated users with contributor or higher privileges to inject arbitrary JavaScript code into pages. The injected scripts execute in the context of users visiting those pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 3.9.12. No known exploits in the wild have been reported, and no official patch or vendor advisory is currently provided.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the browsers of users viewing those pages. This can lead to theft of user credentials, session tokens, or other sensitive information accessible via the browser context. The impact is limited by the requirement for authenticated contributor-level access and does not affect unauthenticated users directly. There is no indication of denial of service or system-level compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only. Monitor plugin updates from wpdevteam for a security patch addressing this vulnerability. Avoid using the vulnerable attribute or widget if possible. No vendor advisory or official patch links are currently provided.