rootpwn

medium · CVSS v3 6.4

CVE-2026-92727

The EmbedPress WordPress plugin (versions ≤4.6.6) contains a stored XSS vulnerability in the slidesShow block attribute. Authenticated users

Overview

The EmbedPress WordPress plugin (versions ≤4.6.6) contains a stored XSS vulnerability in the slidesShow block attribute. Authenticated users with contributor-level access can inject scripts that run when a page is viewed, enabling defacement or data exfiltration. This flaw allows attackers to compromise site integrity and user confidentiality.

Description

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The slidesShow block attribute is interpolated into an unquoted data-carousel-options HTML attribute, allowing a payload containing spaces to break out of the attribute and inject additional DOM attributes such as onfocus event handlers onto the wrapper element.

Impact

Confidentiality: injected scripts can steal user data or session cookies. Integrity: attackers can alter page content or deface the site. Availability: not directly affected. Site administrators and contributors are the primary defenders at risk.

Remediation

Update the EmbedPress plugin to the latest version (≥4.6.7). If an update is not feasible, remove or disable the slidesShow block or restrict contributor-level access to the plugin. Implement a Content Security Policy that blocks inline scripts and enforce server‑side input sanitization.

Risk context

The medium severity and CVSS score of 6.4 indicate a moderate risk. Prompt remediation is recommended to prevent potential XSS exploitation, especially on sites with contributor-level users.

Affected products

  • EmbedPress PDF Embedder
  • EmbedPress 3D PDF FlipBook
  • EmbedPress Google Reviews
  • EmbedPress YouTube Videos
  • EmbedPress Upload PDF

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
—

wordpress xss stored plugin embedpress contributor cve-2026-92727

← All CVEs

Related CVEs

medium

CVE-2026-103762

SiYuan before v3.8.5 has a missing authorization flaw in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read‑only or anonymous publish visitors to discover unpublished notebook box IDs and their creation times. Attackers can POST any open notebook ID to receive the global save‑box ID and save‑path template, revealing hidden notebooks. The vulnerability does not modify data but exposes sensitive metadata.

View analysis

medium

CVE-2026-104910

MISP suffers an authorization bypass in its related events listing, allowing users to retrieve metadata of events they should not see. This can expose threat‑intelligence details across sharing groups.

View analysis

medium

CVE-2026-104474

OpenLiteSpeed versions prior to 1.9.3 allow local privilege escalation via the lsup.sh script. An attacker who can control the nobody web process can replace an autoupdate package, causing root‑privileged install scripts to run. This flaw enables full system compromise on affected servers.

View analysis

medium

CVE-2026-104475

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

View analysis