CVE-2026-85001: EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
Affected Software
Event History
Frequently Asked Questions
Which sites and users are exposed to this issue?
Sites using the EmbedPress WordPress plugin before version 4.6.7 are affected where untrusted users have the Contributor role or a higher role and can configure the affected Elementor widget setting. The injected script executes when someone views the affected content.
What access does an attacker need to exploit it?
An attacker needs a WordPress account with Contributor privileges or above. They must be able to inject a payload through the Elementor widget's showTitle setting.
What version resolves the vulnerability?
Update EmbedPress to version 4.6.7 or later. Versions before 4.6.7 do not sanitise and escape the affected setting before placing it in an HTML attribute.