CVE-2026-61961: WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.

Affected Software

1 affected component

WordPress EmbedPress plugin<=4.5.6

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress EmbedPress Plugin to a version that resolves this vulnerability.
Fixed in 4.6.0

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

CVE-2026-61961 has a high severity rating of 7.1.

To fix CVE-2026-61961, update the WordPress EmbedPress plugin to version 4.5.7 or later.

CVE-2026-61961 is a Cross Site Scripting (XSS) vulnerability.

Anyone using WordPress EmbedPress plugin version 4.5.6 or earlier is affected by CVE-2026-61961.

No authentication is required to exploit CVE-2026-61961, making it easier for attackers.