wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more vulnerabilities

35 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more version is affected

Latest wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more vulnerabilities

CVE-2026-85000 — EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating (CVSS 5.3)
CVE-2026-85001 — EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute (CVSS 6.8)
CVE-2026-85002 — EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes (CVSS 6.8)
CVE-2026-84936 — EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat (CVSS 5.3)
CVE-2026-84927 — EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification (CVSS 2.7)
CVE-2026-84926 — EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route (CVSS 2.7)
CVE-2026-61961 — WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
CVE-2026-10526 — EmbedPress < 4.6.1 - Unauthenticated Blind SSRF (CVSS 5.8)
CVE-2026-48872 — WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability (CVSS 7.5)
CVE-2024-11203 — EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name' (CVSS 5.4)
CVE-2024-38707 — WordPress EmbedPress plugin <= 4.0.4 - Broken Access Control vulnerability (CVSS 8.8)
CVE-2024-50461 — WordPress EmbedPress plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-43936 — WordPress EmbedPress plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-43328 — WordPress EmbedPress plugin <= 4.0.9 - Local File Inclusion vulnerability (CVSS 9.8)
CVE-2023-51375 — WordPress EmbedPress plugin <= 3.8.3 - Broken Access Control vulnerability (CVSS 8.8)
CVE-2024-1565 — EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL (CVSS 5.4)
CVE-2024-31284 — WordPress EmbedPress plugin <= 3.9.8 - Broken Access Control vulnerability (CVSS 9.8)
CVE-2024-31274 — WordPress EmbedPress plugin <= 3.9.11 - Broken Access Control vulnerability (CVSS 5.3)
CVE-2024-5571 — EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget (CVSS 5.4)
CVE-2024-1803 — EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual (CVSS 4.3)
CVE-2024-4316 — EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 5.4)
CVE-2024-3244 — EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
CVE-2024-3245 — EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block (CVSS 5.4)
CVE-2024-2688 — EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color' (CVSS 5.4)
CVE-2024-2468 — EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute (CVSS 5.4)