CVE-2026-7796: EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute

Published Jun 6, 2026
·
Updated

The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

Affected Software

1 affected component
EmbedPress EmbedPress<=4.5.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Remove

    Remove EmbedPress from your environment.

    Uninstall the EmbedPress plugin if it is not required.

  2. Configuration

    Disable the EmbedPress block or remove/disable its 'url' attribute to prevent contributors from injecting scripts. If the plugin provides no setting, remove the block via WordPress block restrictions (e.g., allowed_block_types) or other site-specific filters.

    EmbedPress block 'url' attribute enabled = false
  3. Compensating control

    Restrict content creation and editing to trusted users: limit Contributor+ roles from adding or editing EmbedPress blocks (adjust role/capability settings), and deploy content filtering or a WAF to block inline script tags or likely XSS payloads in page content.

  4. Operational

    Audit existing posts and pages for embedded malicious scripts (particularly in EmbedPress blocks) and remove any injected payloads; restore affected content from clean backups and review recent contributor activity for suspicious changes.

Event History

Jun 6, 2026
CVE Published
via MITRE·02:28 AM
Data Sourced
via MITRE·02:28 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-7796?

CVE-2026-7796 has a medium severity score of 6.4.

2

What is the risk of CVE-2026-7796?

CVE-2026-7796 has an associated risk level of 39.

3

How do I fix CVE-2026-7796?

To fix CVE-2026-7796, update EmbedPress to version 4.5.4 or later.

4

What type of vulnerability is CVE-2026-7796?

CVE-2026-7796 is a Stored Cross-Site Scripting (XSS) vulnerability.

5

Which versions of EmbedPress are affected by CVE-2026-7796?

CVE-2026-7796 affects all versions of EmbedPress up to and including 4.5.3.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2026-7796 - EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute - SecAlerts