EmbedPress EUVD-2026-91896

Requires an authenticated account with contributor-level privileges or above (PR:L), and the target page must use the EmbedPress Gutenberg block so the attacker-controlled 'slidesShow' attribute is rendered. The specific technical prerequisite is that slidesShow is interpolated into an UNQUOTED data-carousel-options HTML attribute, so a payload containing spaces can break out and inject DOM attributes (e.g. onfocus). Exploitation is limited by: the need for a contributor account (sites without open registration or untrusted authors are largely unaffected), affected versions up to and including 4.6.6, and the fact that script execution depends on a user subsequently rendering the injected page.

This is a moderate-priority stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) rather than a critical emergency. The CVSS vector signals low attack complexity and network reachability, but the PR:L requirement means an attacker must already hold a contributor-level (or higher) account, which substantially narrows the realistic threat population to sites that allow untrusted user registration/contributor roles. No EPSS score was provided, there is no CISA KEV listing (no confirmed active exploitation), and no public exploit code is referenced in the sources, so all three real-world-exploitation signals are either absent or negative. The scope change (S:C) and C:L/I:L reflect that injected script executes in the browser of other users (potentially higher-privileged admins viewing the page), which is the main reason this merits timely patching despite the authentication barrier. Net: a genuine but role-gated issue - prioritize on multi-author/community WordPress sites, deprioritize on single-admin installations. No conflicting signals were found between the CVSS vector and the description; both consistently describe authenticated, network-exploitable stored XSS.

An attacker registers or obtains a contributor account on a WordPress site running EmbedPress <= 4.6.6, then creates a post using the EmbedPress block and sets the 'slidesShow' attribute to a payload containing spaces (e.g. breaking out of the unquoted data-carousel-options attribute to add an onfocus handler). When an administrator or visitor later views the page, the injected script executes in their browser session, enabling session/cookie theft or admin-context actions. No public proof-of-concept is referenced in the provided intelligence.