This vulnerability (CVE-2026-61961) in EmbedPress versions <=4.5.6 is an unauthenticated Cross-Site Scripting (XSS) flaw. It arises from improper neutralization of input during web page generation, enabling attackers to inject malicious scripts. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, modification, or disruption of service. Because the vulnerability is unauthenticated, any remote attacker can attempt exploitation. However, user interaction is required for the attack to succeed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or sanitizing user inputs where possible and monitoring for suspicious activity related to this plugin. Avoid relying on generic mitigations that are not specific to this vulnerability.