CVE-2026-7796: EmbedPress WordPress Plugin Stored XSS Vulnerability (CVSS 6.4)

Technical summary

CVE-2026-7796 is a stored XSS vulnerability in the EmbedPress plugin for WordPress, tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability exists in the block 'url' attribute handling, where insufficient input sanitization and output escaping allows authenticated users with contributor role or higher to persist malicious JavaScript code. The injected payload is stored server-side and executed in the context of any user's browser that accesses the affected page, establishing a persistent attack vector. The CVSS 3.1 base score of 6.4 (MEDIUM severity, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects that exploitation requires network access and low-level authentication privileges, but impacts confidentiality and integrity across site boundaries.

Business impact

Organizations running EmbedPress should assess whether contributor-level users are trusted, as this vulnerability enables those users to compromise page integrity and user trust. Stored XSS on public-facing pages can lead to credential harvesting, session hijacking, or malware distribution to site visitors. For multi-user WordPress installations—particularly those accepting guest authors or managing community content—this represents a meaningful insider risk. Remediation delays expose the organization to persistent payload execution and potential secondary compromises of visitor accounts.

Affected systems

The EmbedPress – PDF Embedder plugin for WordPress is affected in all versions up to and including 4.5.3. The vulnerability requires authenticated access at contributor level or above; it does not affect unauthenticated visitors. WordPress installations with the plugin active and users granted contributor, author, or editor roles are in scope. Unaffected versions and patched releases should be confirmed against the official plugin repository or vendor advisory.

Exploitability

Exploitation requires a valid WordPress user account with contributor-level permissions or higher. No public exploit code is known to be active; the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the barrier to weaponization is low: an attacker with such credentials can inject scripts through the block 'url' attribute using standard WordPress editor interfaces. The attack is stored and executed passively when victims access the page, removing the need for social engineering or victim interaction. Organizations with strict access controls limiting contributor roles face lower risk.

Remediation

Immediately update the EmbedPress plugin to a patched version that addresses the input sanitization and output escaping deficiencies. Verify the patched version against the official WordPress plugin repository or the vendor security advisory. Pending patch deployment, restrict contributor-level access to trusted users only, or temporarily deactivate the plugin if it is not critical to operations. After patching, audit existing pages and posts for injected scripts or unusual content in the block 'url' attributes, and review contributor activity logs for suspicious changes.

Patch guidance

Check the official EmbedPress plugin page on WordPress.org for available updates. Apply the patch that addresses the sanitization and escaping issues in the block 'url' attribute. Verify the update version exceeds 4.5.3. Test the update in a staging environment before production deployment to ensure compatibility with your site's theme and other plugins. Enable automatic updates for the plugin if your update policy permits, and configure WordPress security scanners to monitor for this CVE.

Detection guidance

Monitor WordPress activity logs and audit trails for modifications to pages or posts containing EmbedPress blocks, especially by lower-privileged users. Search the site's database and post content for suspicious JavaScript or iframe injection patterns in block 'url' attributes. Use WordPress security plugins with XSS detection capabilities to scan for stored payloads. Review user permissions and audit contributor account creation and usage. Inspect HTTP responses for unexpected script tags or event handlers in embedded content. Network-level detection is limited because payloads are stored server-side; focus on content inspection and access logs.

Why prioritize this

This vulnerability merits prompt attention because it enables authenticated attackers to compromise site content and visitor trust through persistent injection. The MEDIUM severity rating and lack of active exploitation do not justify deferral; the simplicity of exploitation for privileged users, combined with the scope crossing (affecting other users' browsing contexts), makes it a practical risk to multi-user WordPress sites. Organizations with guest authors or high-volume contributor accounts should prioritize patching within 1–2 weeks. Those with tightly controlled contributor access may extend the timeline slightly, but should not delay beyond 3–4 weeks.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects the following: Network accessibility (AV:N) and low attack complexity (AC:L) make the vulnerability easy to exploit once authenticated. However, the requirement for authenticated access with contributor privilege (PR:L) and no user interaction (UI:N) constrains the initial attack surface. Scope Changing (S:C) increases the score because the injected script affects other users' security contexts. Confidentiality and Integrity impacts (C:L, I:L) are limited in magnitude but meaningful, as they enable credential theft or unauthorized page modification rather than system-wide compromise. No availability impact (A:N) is expected. The result is a MEDIUM-severity vulnerability that requires proactive patching but is not typically grounds for emergency response.

Frequently asked questions