The EmbedPress plugin for WordPress, which allows embedding PDFs, YouTube videos, and other documents, suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-2688. This vulnerability is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of user-supplied attributes in the document widget. Attackers with contributor-level privileges or higher can inject arbitrary web scripts that persist and execute in the context of users visiting the compromised pages. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality and integrity impact without availability impact.

An authenticated attacker with contributor-level access or higher can inject persistent malicious scripts into pages using the EmbedPress document widget. These scripts execute in the context of users viewing the affected pages, potentially leading to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the EmbedPress plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.