# CVE-2026-92727: EmbedPress plugin stored XSS in slidesShow block attribute

Source: https://junglewise.ai/threats/cve-2026-92727-the-embedpress-pdf-embedder-3d-pdf-flipbook-google-reviews  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-03. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-92727 · Severity: medium · CVSS 6.4 · Published 2026-10-03

The EmbedPress plugin for WordPress, which allows users to embed PDFs and multimedia content into web pages, is vulnerable to stored cross-site scripting (XSS). An authenticated attacker with contributor-level access can inject malicious scripts into pages through the slidesShow block attribute; these scripts will execute in the browsers of anyone viewing the affected pages, potentially compromising visitor accounts and data.

Technologies: [EmbedPress](https://junglewise.ai/threats/technologies/embedpress-embedpress). Vendors: [EmbedPress](https://junglewise.ai/threats/vendors/embedpress).

## Quick answers

**Is CVE-2026-92727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92727 being exploited in the wild.

**How severe is CVE-2026-92727?** Medium severity, with a CVSS score of 6.4, published 3 October 2026.

**Which products and versions are affected?** EmbedPress up to and including 4.6.6.

**Is there a fix for CVE-2026-92727?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92727 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92727?** Check whether you run EmbedPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the slidesShow block attribute of EmbedPress, where user input is inserted into an unquoted HTML data attribute without proper sanitization or escaping. An attacker can break out of the attribute using spaces and inject additional DOM attributes such as onfocus event handlers. The vulnerability requires authentication with contributor-level access or higher, and affects all versions up to and including 4.6.6.

## Affected products

- EmbedPress EmbedPress up to and including 4.6.6

## Timeline

- 2026-10-03: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/embedpress/tags/4.6.6/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php](https://plugins.trac.wordpress.org/browser/embedpress/tags/4.6.6/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php)
- [https://plugins.trac.wordpress.org/browser/embedpress/tags/4.6.6/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php](https://plugins.trac.wordpress.org/browser/embedpress/tags/4.6.6/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php)

## Related threats

- [EmbedPress stored cross-site scripting in block attributes](https://junglewise.ai/threats/cve-2026-85002-the-embedpress-wordpress-plugin-before-4-6-7-does-not-escape-one)