CVE-2026-7796: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdevteam EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more
EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more WordPress plugin versions up to and including 4.5.3 contain a stored cross-site scripting (XSS) vulnerability. The issue arises from insufficient sanitization and escaping of the 'url' attribute in a block, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute when any user views the affected page. The vulnerability has a medium severity rating with a CVSS score of 6.4.
AI Analysis
Technical Summary
The EmbedPress WordPress plugin up to version 4.5.3 is vulnerable to stored cross-site scripting (CWE-79) due to improper neutralization of input in the 'url' attribute of a block. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the compromised pages. This vulnerability stems from insufficient input sanitization and output escaping, enabling persistent script injection.
Potential Impact
An attacker with contributor-level access or above can inject malicious scripts into pages via the vulnerable 'url' attribute. These scripts execute in the browsers of users who visit the injected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.
Mitigation Recommendations
No official patch or remediation has been confirmed as available. Users should check the vendor's advisory or plugin updates for fixes beyond version 4.5.3. Until a fix is available, restrict contributor-level access carefully and consider disabling or removing the plugin if possible to mitigate risk.
CVE-2026-7796: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdevteam EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more
Description
EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more WordPress plugin versions up to and including 4.5.3 contain a stored cross-site scripting (XSS) vulnerability. The issue arises from insufficient sanitization and escaping of the 'url' attribute in a block, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute when any user views the affected page. The vulnerability has a medium severity rating with a CVSS score of 6.4.
CVSS v3.1
Score 6.4medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The EmbedPress WordPress plugin up to version 4.5.3 is vulnerable to stored cross-site scripting (CWE-79) due to improper neutralization of input in the 'url' attribute of a block. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the compromised pages. This vulnerability stems from insufficient input sanitization and output escaping, enabling persistent script injection.
Potential Impact
An attacker with contributor-level access or above can inject malicious scripts into pages via the vulnerable 'url' attribute. These scripts execute in the browsers of users who visit the injected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.
Mitigation Recommendations
No official patch or remediation has been confirmed as available. Users should check the vendor's advisory or plugin updates for fixes beyond version 4.5.3. Until a fix is available, restrict contributor-level access carefully and consider disabling or removing the plugin if possible to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-04T19:08:09.496Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a239510e29bf47b5005f845
Added to database: 06/06/2026, 03:33:36 UTC
Last enriched: 06/13/2026, 09:56:27 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.