CVE-2026-85002: EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress contributor role or a higher-privileged role can exploit it by supplying a malicious value in an Instagram Carousel block attribute. The payload is stored in a post and runs when a higher-privileged user views that post.
Which installations are affected?
EmbedPress versions before 4.6.7 are affected. The issue is specifically associated with output of an Instagram Carousel block attribute.
What should be done if an update cannot be applied immediately?
Limit contributor and other untrusted users' ability to create or edit posts containing EmbedPress Instagram Carousel blocks, and review posts created by those users before higher-privileged staff view them.