Executive brief
The EmbedPress plugin for WordPress allows unauthenticated attackers to inject malicious scripts into web pages through a parameter in the URL. If a user clicks a crafted link, the attacker's script executes in the user's browser with their privileges, potentially stealing session tokens, redirecting to phishing pages, or defacing content.
Technical details
The plugin contains a reflected Cross-Site Scripting (XSS) vulnerability in the 'unique' parameter due to insufficient input sanitization and output escaping. The vulnerability was introduced in version 4.3.0 during a refactor that removed the esc_url() function that had previously remediated an equivalent issue (CVE-2023-5749). An unauthenticated attacker can craft a malicious URL with JavaScript in the 'unique' parameter, and if a user clicks the link, the script executes in their browser context. No authentication is required, and the attack vector is network-based, requiring only user interaction. A patch is expected to restore proper output escaping.
Affected products
- EmbedPress PDF Embedder up to and including 4.6.5
Timeline
- 2026-09-18: disclosed