CVE-2026-89330: EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is a regression: the escurl() wrapper that remediated the equivalent CVE-2023-5749 in version 3.9.2 was removed in version 4.3.0 during a refactor that introduced the 'unique' parameter.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected by this regression?
EmbedPress versions 4.3.0 through 4.6.5 are affected. Version 4.3.0 introduced the unique parameter and removed the esc_url() wrapper that had remediated the equivalent earlier issue.
Does exploitation require an authenticated WordPress account?
No. An unauthenticated attacker can supply a malicious unique parameter, but must persuade a user to perform an action such as clicking a crafted link for the script to execute.
What is the likely impact if exploitation succeeds?
The injected script executes in the context of the affected page, allowing impacts to confidentiality and integrity. The supplied severity vector indicates no direct availability impact.