Junglewise Threat Intelligence

CVE-2026-7796: WPDeveloper EmbedPress Stored XSS in Gutenberg block url attribute

CVE-2026-7796 · Severity: medium · CVSS 6.4 · Published 2026-06-06

Technologies: WPDeveloper EmbedPress. Vendors: WPDeveloper.

Executive brief

EmbedPress, a WordPress plugin used to embed multimedia content like PDFs and YouTube videos, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into website pages. When other users or administrators visit these compromised pages, the scripts execute automatically in their browsers. This could lead to unauthorized actions being performed on behalf of site visitors or the theft of sensitive session information.

Technical details

The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'url' attribute within its Gutenberg blocks. This vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into the database. These scripts are then executed in the context of any user's browser who views the affected page. The flaw is present in all versions up to and including 4.5.3. A patch has been released in subsequent versions to address the sanitization issues in EmbedPressBlockRenderer.php and Helper.php.

Affected products

  • WPDeveloper EmbedPress up to, and including, 4.5.3

Timeline

  • 2026-06-06: disclosed
  • 2026-06-06: advisory

References

Related threats