EmbedPress CVE-2026-85001

Requires an authenticated user with Contributor role or above on a WordPress site running EmbedPress before 4.6.7 with the Elementor page builder active (the vulnerable setting is an EmbedPress Elementor widget option). The attacker must save a payload into the specific unsanitized widget setting, and exploitation only triggers when another user views the affected content (UI:R). Limiting factors: privileged account needed (not unauthenticated), Elementor must be in use, and a victim must view the injected content - no known active exploitation and no POC available.

This is a stored/reflected XSS (CWE-79) in the EmbedPress plugin's Elementor widget settings, requiring an attacker with Contributor role or above. Real-world risk is moderate-to-low despite the 6.8 'Medium' score. SSVC from CISA is decisive here: Exploitation=none (no known exploitation), Automatable=no (requires an authenticated privileged user and victim interaction), which together argue against urgent prioritization. There is no EPSS score, no KEV listing, and no public POC identified. IMPORTANT CONFLICT: the input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) is inconsistent with the described vulnerability. A Contributor role maps to PR:L, not PR:H, and a typical XSS that runs script in a viewer's browser produces a scope change (S:C) with limited C/I/A (C:L/I:L/A:N), not the full-system total impact (S:U/C:H/I:H/A:H) shown. The SSVC 'Technical Impact: total' rating appears to have driven the inflated C:H/I:H/A:H, but for reflected/stored XSS in a widget attribute the realistic impact is limited script execution in the context of whoever views the content. My independent recomputation yields ~5.4. Net: a legitimate defect worth patching, but not a widespread-exploitation priority.

An attacker who already holds a Contributor (or higher) account on a WordPress site running EmbedPress edits an Elementor widget and injects a malicious payload into the vulnerable, unsanitized widget setting. When an editor, administrator, or site visitor subsequently views the page containing that widget, the injected script executes in their browser session, potentially enabling session/cookie theft or actions in the victim's authenticated context. No public POC has been identified, and exploitation requires both a privileged authenticated account and a victim viewing the content.