Unknown Embedpress vulnerabilities

7 CVEs affecting Unknown Embedpress, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85000, published 2026-10-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-10526, published 2026-08-04. Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days. The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce…
CVE-2026-84926, published 2026-09-05. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level…
CVE-2026-84936, published 2026-09-05. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable…
CVE-2026-84927, published 2026-09-05. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to…
CVE-2026-85000, published 2026-10-14. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API…
CVE-2026-85001, published 2026-09-30. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the…
CVE-2026-85002, published 2026-09-27. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to…