What is the CVSS score of CVE-2026-7796?

CVE-2026-7796 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

EmbedPress CVE-2026-7796

EUVD-2026-34951 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-06 Wordfence

GHSA-5m2w-5g87-p5fp

WordPress XSS Wordpress Plugin Embedpress Pdf Embedder Embed Pdf Viewer Youtube Videos 3D Flipbook Social Feeds More Wpdevteam

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 03:53 vuln.today

CVE Published

Jun 06, 2026 - 02:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The EmbedPress - PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

AnalysisAI

Stored Cross-Site Scripting in the EmbedPress WordPress plugin (all versions through 4.5.3) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript via the block 'url' attribute, executing in the browsers of any user who visits an affected page. The vulnerability originates in insufficient sanitization within EmbedPressBlockRenderer.php and Helper.php, as confirmed by Wordfence and traceable to specific lines in the plugin's source repository. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that successful exploitation affects resources beyond the vulnerable component itself - namely, victim browser sessions.

Technical ContextAI

EmbedPress is a WordPress Gutenberg block plugin developed by WPDevTeam (CPE: cpe:2.3:a:wpdevteam:embedpress_-_pdf_embedder,_embed_pdf_viewer,_youtube_videos,_3d_flipbook,_social_feeds_&_more:*:*:*:*:*:*:*:*) that enables embedding of PDFs, YouTube videos, 3D flipbooks, and social feeds via a 'url' block attribute. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to sanitize user-supplied input in the 'url' parameter and escape it before rendering in page output. The vulnerable logic is confirmed in EmbedPressBlockRenderer.php (at lines L1181 and L133 across versions 4.4.11 and 4.5.1) and Helper.php (line L1659). These files handle rendering of embed blocks in the Gutenberg editor context, where contributor-level users have edit access by default in most WordPress configurations.

RemediationAI

Upstream fix is available per WordPress plugin repository changeset 3546981 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3546981%40embedpress&new=3546981%40embedpress), which modifies the vulnerable rendering code in trunk. Site administrators should update the EmbedPress plugin to the latest available version beyond 4.5.3 via the WordPress admin dashboard or WP-CLI (wp plugin update embedpress); the exact patched release version is not independently confirmed from the available data - verify the installed version exceeds 4.5.3 post-update. As a compensating control pending update, restrict the WordPress contributor role from being assigned to untrusted users and audit existing contributor accounts for unauthorized additions - this limits the attack surface to trusted internal users. Alternatively, temporarily deactivating the EmbedPress plugin eliminates the attack vector entirely at the cost of losing all embed functionality. Content Security Policy (CSP) headers with a restrictive script-src directive can reduce the impact of successful XSS injection but will not prevent the vulnerability from being triggered.