VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

EmbedPress security & vulnerabilities

embedpress— active installsLast vulnerability Oct 2, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
40Known vulnerabilities
  • Critical1
  • High2
  • Medium37
  • Low0
Vulnerabilities per year
2023: 8 vulnerabilities8232024: 21 vulnerabilities21242026: 11 vulnerabilities1126

All EmbedPress vulnerabilities

EmbedPress vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute
≤4.6.6Update to 4.6.7
CVE-2026-92727
Medium6.44.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
4.4.9 – 4.6.6Update to 4.6.7
CVE-2026-85001
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.6.6Update to 4.6.7
CVE-2026-85002
Medium6.1Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
≤4.6.5Update to 4.6.6
CVE-2026-89330
Medium4.34.6.3 - Missing Authorization
4.6.0 – 4.6.3Update to 4.6.4
CVE-2026-84926
Medium4.34.6.3 - Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification
4.6.0 – 4.6.3Update to 4.6.4
CVE-2026-84927
Medium5.34.6.3 - Unauthenticated Paid API Consumption and Database Row Injection
4.6.0 – 4.6.3Update to 4.6.4
CVE-2026-84936
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.5.6Update to 4.6.0
CVE-2026-61961
High7.2Unauthenticated Blind Server-Side Request Forgery
≤4.6.0Update to 4.6.1
CVE-2026-10526
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute
≤4.5.3Update to 4.5.4
CVE-2026-7796
Medium5.3Unauthenticated Information Exposure
≤4.5.2Update to 4.5.3
CVE-2026-48872
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'
≤4.1.3Update to 4.1.4
CVE-2024-11203
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.0.14Update to 4.1.0
CVE-2024-50461
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.0.8Update to 4.0.9
CVE-2024-43936
Critical9.8Unauthenticated Local File Inclusion
≤4.0.9Update to 4.0.10
CVE-2024-43328
Medium5.3Missing Authorization
≤4.0.4Update to 4.0.5
CVE-2024-38707
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL
≤3.9.10Update to 3.9.11
CVE-2024-1565
Medium6.4 Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget
≤4.0.1Update to 4.0.2
CVE-2024-5571
Medium4.3Insufficient Authorization Checks to Block Usual
≤3.9.12Update to 3.9.13
CVE-2024-1803
Medium6.4Arbitrary JavaScript Execution
≤0.21.5Update to 0.21.6
CVE-2024-4367
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
≤3.9.16Update to 3.9.17
CVE-2024-4316
Medium5.3Missing Authorization
≤3.9.11Update to 3.9.12
CVE-2024-31274
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.9.14Update to 3.9.15
CVE-2024-3244
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block
≤3.9.14Update to 3.9.15
CVE-2024-3245
Medium5.3Missing Authorization via handle_calendly_data
≤3.9.8Update to 3.9.9
CVE-2024-31284
Medium5.4Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color'
≤3.9.12Update to 3.9.13
CVE-2024-2688
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute
≤3.9.12Update to 3.9.13
CVE-2024-2468
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget
≤3.9.10Update to 3.9.11
CVE-2024-2128
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block
≤3.9.10Update to 3.9.11
CVE-2024-1802
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.9.8Update to 3.9.9
CVE-2024-1349
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link
≤3.9.8Update to 3.9.9
CVE-2024-1425
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
<3.9.5Update to 3.9.6
CVE-2023-6986
Medium5.3Missing Authorization
<3.9.5Update to 3.9.5
—
Medium6.1Reflected Cross-Site Scripting
≤3.9.1Update to 3.9.2
CVE-2023-5749
Medium6.1Reflected Cross-Site Scripting
≤3.9.1Update to 3.9.2
CVE-2023-5750
Medium4.3Cross-Site Request Forgery
<3.8.4Update to 3.8.4
CVE-2023-51375
Medium5.4Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data
≤3.8.2Update to 3.8.3
CVE-2023-4282
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.8.2Update to 3.8.3
CVE-2023-4283
Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
CVE-2023-33999
Medium5.3Sensitive Information Exposure
≤3.7.3Update to 3.8.0
CVE-2023-3371

EmbedPress: common questions

Does EmbedPress have known vulnerabilities?

Yes. VulnCrest Radar lists 40 known vulnerabilities in EmbedPress: 1 critical, 2 high, 37 medium. At least one is not fixed in the latest version.

How do I check which version of EmbedPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent EmbedPress vulnerability?

CVE-2026-92727, published Oct 2, 2026: EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute. Severity: Medium (CVSS 6.4).

Is any EmbedPress vulnerability listed in CISA KEV?

No. None of the known EmbedPress vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?