CVE-2026-92727: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
EmbedPress plugin for WordPress versions up to 4.6.6 contains a stored cross-site scripting (XSS) vulnerability via the 'slidesShow' block attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from improper input sanitization and output escaping, allowing injection through an unquoted HTML attribute.
AI Analysis
Technical Summary
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents WordPress plugin is vulnerable to stored cross-site scripting (CWE-79) in all versions up to and including 4.6.6. The issue is due to insufficient sanitization and escaping of the 'slidesShow' block attribute, which is interpolated into an unquoted data-carousel-options HTML attribute. This allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts by breaking out of the attribute context and injecting additional DOM attributes such as event handlers. These scripts execute whenever a user accesses the injected page.
Potential Impact
An attacker with contributor-level access or higher can inject persistent malicious scripts into pages, which execute in the context of users who view those pages. This can lead to partial compromise of confidentiality and integrity (CVSS impact: low confidentiality and integrity impact, no availability impact). The vulnerability does not require user interaction beyond viewing the affected page and can affect all users who access the injected content.
Mitigation Recommendations
No official patch or fix is currently confirmed. Users should check the vendor advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the affected plugin if possible. Monitor for plugin updates that address this vulnerability.
CVE-2026-92727: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
Description
EmbedPress plugin for WordPress versions up to 4.6.6 contains a stored cross-site scripting (XSS) vulnerability via the 'slidesShow' block attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from improper input sanitization and output escaping, allowing injection through an unquoted HTML attribute.
CVSS v3.1
Score 6.4medium
Affected software
wpdevteam
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents WordPress plugin is vulnerable to stored cross-site scripting (CWE-79) in all versions up to and including 4.6.6. The issue is due to insufficient sanitization and escaping of the 'slidesShow' block attribute, which is interpolated into an unquoted data-carousel-options HTML attribute. This allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts by breaking out of the attribute context and injecting additional DOM attributes such as event handlers. These scripts execute whenever a user accesses the injected page.
Potential Impact
An attacker with contributor-level access or higher can inject persistent malicious scripts into pages, which execute in the context of users who view those pages. This can lead to partial compromise of confidentiality and integrity (CVSS impact: low confidentiality and integrity impact, no availability impact). The vulnerability does not require user interaction beyond viewing the affected page and can affect all users who access the injected content.
Mitigation Recommendations
No official patch or fix is currently confirmed. Users should check the vendor advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the affected plugin if possible. Monitor for plugin updates that address this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-16T17:28:45.189Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac07aa9a43b0b3b89999cca
Added to database: 10/03/2026, 03:46:49 UTC
Last enriched: 10/03/2026, 04:01:24 UTC
Last updated: 10/03/2026, 04:23:35 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.