Embedpress (Unknown) - vulnerabilities (CVEs)

9 CVEs, 2 in the last 30 days, 1 known versions, newest CVE from 2026-10-14. Vendor: Unknown.

CVEs of Embedpress

• CVE-2026-85000 - CVSS 5.3 (medium), 2026-10-14: The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side,…
• CVE-2026-85001 - CVSS 6.8 (medium), 2026-09-30: The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute,…
• CVE-2026-85002 - CVSS 6.8 (medium), 2026-09-27: The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow…
• CVE-2026-84936 - CVSS 5.3 (medium), 2026-09-05: The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the…
• CVE-2026-84927 - CVSS 2.7 (low), 2026-09-05: The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users…
• CVE-2026-84926 - CVSS 2.7 (low), 2026-09-05: The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any…
• CVE-2026-10526 - CVSS 5.8 (medium), 2026-08-04: The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints,…
• CVE-2023-5750 - CVSS 6.1 (medium), 2023-12-11: The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content,…
• CVE-2023-5749 - CVSS 6.1 (medium), 2023-12-11: The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site…