EmbedPress CVE-2026-85002

Requires an authenticated attacker holding at least the Contributor role on the target WordPress site running EmbedPress before 4.6.7, and the attacker must insert a malicious EmbedPress block attribute into a post. Exploitation further requires user interaction (UI:R): a higher-privileged user (Editor/Administrator) must view or preview the attacker-authored post for the stored payload to fire. This is not exploitable against default configurations without an existing low-privilege account, and does not affect sites that restrict contributor-level authoring.

This is a plausible but low-priority stored XSS. Signals are consistent and point AWAY from urgent action: EPSS is 0.15% (4th percentile), the vulnerability is NOT in CISA KEV, and CISA SSVC scores Exploitation as 'none' (no observed exploitation) with Automatable 'no' - meaning it cannot be reliably mass-exploited. Technical Impact is rated 'total' by SSVC, which drives the vendor's high 6.8 score, but that rating conflicts with the mechanics of the flaw. A public PoC exists (WPScan), which raises exploitability slightly above theoretical, but PoC availability is distinct from active exploitation. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H = 6.8) is internally inconsistent with the description: the description says a *contributor role* attacker is sufficient, which is a low-privilege authenticated user (PR:L), not PR:H; a stored XSS that fires in a higher-privileged victim's browser is a scope change (S:C), not S:U; and browser-context script injection realistically yields partial C:L/I:L rather than full C:H/I:H/A:H. A corrected vector lands closer to 5.4 (medium). Net: real but constrained - a low-priv authenticated foothold is required and a higher-privileged user must view the malicious post, so this is not a widespread, automatable threat.

An attacker who has obtained a Contributor account on a WordPress site running EmbedPress < 4.6.7 crafts a post containing an EmbedPress block whose unescaped attribute carries a malicious payload. When an Editor or Administrator later opens or previews that post, the script executes in their authenticated session, enabling actions such as creating a rogue admin or altering site content. A public PoC is available via WPScan, lowering the effort to reproduce.