What’s Vulnerable › Vulnerabilities
CVE-2026-85001: EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-30 · updated 2026-09-30
- Weakness: CWE-79
Description
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
Affected products
- wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more: from 4.4.9 before 4.6.7 — fixed in 4.6.7
How to fix
Upgrade to a fixed version: wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more 4.6.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85001 or the next vulnerability affects your stack