Embedpress Pdf Embedder 3D Pdf Flipbook Google Reviews Youtube Videos Upload Embed Pdf Documents
Monthly
Stored cross-site scripting in the EmbedPress WordPress plugin (all versions up to and including 4.6.6) lets authenticated users with contributor-level access or higher inject arbitrary JavaScript that executes for anyone viewing the affected page. The flaw lives in the plugin's Gutenberg block rendering path, where the attacker-controlled 'slidesShow' attribute is interpolated into an unquoted data-carousel-options HTML attribute; a payload containing spaces breaks out of that attribute and injects additional DOM attributes such as onfocus event handlers onto the wrapper element. Exploitation requires a contributor account and a page that renders the EmbedPress block, and no public exploit code or confirmed active exploitation was identified at time of analysis; the Wordfence-sourced CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate-priority issue rather than a critical emergency.
Reflected cross-site scripting in the EmbedPress WordPress plugin through version 4.6.5 lets unauthenticated attackers inject arbitrary JavaScript into a page returned to a victim who clicks a crafted link carrying a payload in the plugin's 'unique' parameter. Any WordPress site with the plugin installed and active at or below 4.6.5 is exposed, though exploitation depends on successful social engineering because the script is reflected per-request rather than stored, and the most impactful target is a logged-in administrator. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; this is a moderate, vendor-assigned CVSS 6.1 issue and a regression of CVE-2023-5749, whose esc_url() escaping was removed in the 4.3.0 refactor that introduced the 'unique' parameter.
Stored cross-site scripting in the EmbedPress WordPress plugin (all versions up to and including 4.6.6) lets authenticated users with contributor-level access or higher inject arbitrary JavaScript that executes for anyone viewing the affected page. The flaw lives in the plugin's Gutenberg block rendering path, where the attacker-controlled 'slidesShow' attribute is interpolated into an unquoted data-carousel-options HTML attribute; a payload containing spaces breaks out of that attribute and injects additional DOM attributes such as onfocus event handlers onto the wrapper element. Exploitation requires a contributor account and a page that renders the EmbedPress block, and no public exploit code or confirmed active exploitation was identified at time of analysis; the Wordfence-sourced CVSS of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a moderate-priority issue rather than a critical emergency.
Reflected cross-site scripting in the EmbedPress WordPress plugin through version 4.6.5 lets unauthenticated attackers inject arbitrary JavaScript into a page returned to a victim who clicks a crafted link carrying a payload in the plugin's 'unique' parameter. Any WordPress site with the plugin installed and active at or below 4.6.5 is exposed, though exploitation depends on successful social engineering because the script is reflected per-request rather than stored, and the most impactful target is a logged-in administrator. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; this is a moderate, vendor-assigned CVSS 6.1 issue and a regression of CVE-2023-5749, whose esc_url() escaping was removed in the 4.3.0 refactor that introduced the 'unique' parameter.