# EmbedPress

> EmbedPress lets you embed videos, pages, social feeds, embed PDF 3D flipbooks & other content on WordPress without coding & enhance storytelling.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:29 UTC.

## Facts (WordPress.org)

- Slug: `embedpress`
- Author: WPDeveloper
- Version: 4.7.2
- Active installs: 100,000+
- Last update: 2026-11-04 (9 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.2, PHP 5.6
- Tags: embed, embed pdf, Embed youtube, google docs, social feeds
- Page: https://wordpress.org/plugins/embedpress/

## Checks (against WordPress 7.1.4)

- OK: Updated 9 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Phones home ↔ Private, Inaccessible ↔ Accessible, Heavy ↔ Light, Behind ↔ Current, Pushy ↔ Fair.

## Known vulnerabilities

- 2026-10-14 MEDIUM: Missing Authorization (before 4.6.8). CVE-2026-85000, https://wpscan.com/vulnerability/3c7f7d07-2c46-4839-b97f-27fe41e6292d/
- 2026-10-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute (up to 4.6.6). CVE-2026-92727, https://www.wordfence.com/threat-intel/vulnerabilities/id/e2a22349-caa7-4756-ad2f-1861ccff6c30?source=api-prod
- 2026-09-30 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (4.4.9 to 4.6.6). CVE-2026-85001, https://www.wordfence.com/threat-intel/vulnerabilities/id/cac173ab-0f28-4d00-9e4f-f1819d62d92f?source=api-prod
- 2026-09-27 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.6.6). CVE-2026-85002, https://www.wordfence.com/threat-intel/vulnerabilities/id/4b99cbef-2d36-4cd7-9996-e6c9ae2da6d0?source=api-prod
- 2026-09-18 MEDIUM: Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters (up to 4.6.5). CVE-2026-89330, https://www.wordfence.com/threat-intel/vulnerabilities/id/d8b0f381-c07c-4560-bb5c-3a6aee442390?source=api-prod
- 2026-09-05 MEDIUM: Missing Authorization (4.6.0 to 4.6.3). CVE-2026-84926, https://www.wordfence.com/threat-intel/vulnerabilities/id/f3729b1f-88a9-4d1a-8367-18dd0a0bb2f2?source=api-prod
- 2026-09-05 MEDIUM: Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification (4.6.0 to 4.6.3). CVE-2026-84927, https://www.wordfence.com/threat-intel/vulnerabilities/id/afb2bef8-a9aa-46a2-8966-85b35ea9cfa6?source=api-prod
- 2026-09-05 MEDIUM: Unauthenticated Paid API Consumption and Database Row Injection (4.6.0 to 4.6.3). CVE-2026-84936, https://www.wordfence.com/threat-intel/vulnerabilities/id/0bd24676-7ac3-4e8b-90a2-0cb754eea764?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.5.6). CVE-2026-61961, https://www.wordfence.com/threat-intel/vulnerabilities/id/6ce177e7-a009-4b5d-ba4c-971de5496dca?source=api-prod
- 2026-08-04 HIGH: Unauthenticated Blind Server-Side Request Forgery (up to 4.6.0). CVE-2026-10526, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9e4d07-d78f-4bb9-ac7a-286115ed6c34?source=api-prod
- 2026-06-15 MEDIUM: Unauthenticated Information Exposure (up to 4.5.2). CVE-2026-48872, https://www.wordfence.com/threat-intel/vulnerabilities/id/82d87c8b-c503-43e8-aba9-cc98427e0859?source=api-prod
- 2026-06-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute (up to 4.5.3). CVE-2026-7796, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b5b6bc-5f4f-4cf8-987e-b20e8354d863?source=api-prod
- 2024-11-27 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name' (up to 4.1.3). CVE-2024-11203, https://www.wordfence.com/threat-intel/vulnerabilities/id/167dedfa-36cc-4b01-8ea4-8eda8742953c?source=api-prod
- 2024-10-24 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.0.14). CVE-2024-50461, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6851bb9-f15a-4d37-8a15-f4677bd5d62e?source=api-prod
- 2024-08-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.0.8). CVE-2024-43936, https://www.wordfence.com/threat-intel/vulnerabilities/id/31f8bd62-32de-468c-9bed-e03374cb595c?source=api-prod
- 2024-08-16 CRITICAL: Unauthenticated Local File Inclusion (up to 4.0.9). CVE-2024-43328, https://www.wordfence.com/threat-intel/vulnerabilities/id/21a1b117-945f-49bc-9ea1-313afa93bf32?source=api-prod
- 2024-07-11 MEDIUM: Missing Authorization (up to 4.0.4). CVE-2024-38707, https://www.wordfence.com/threat-intel/vulnerabilities/id/f507cec5-d66c-4cb0-8c35-a985aaee1283?source=api-prod
- 2024-06-12 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL (up to 3.9.10). CVE-2024-1565, https://www.wordfence.com/threat-intel/vulnerabilities/id/caa97ae8-40a8-4ca1-820b-83675c053bfc?source=api-prod
- 2024-06-04 MEDIUM:  Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget (up to 4.0.1). CVE-2024-5571, https://www.wordfence.com/threat-intel/vulnerabilities/id/7becdab6-f952-4649-8cea-4efadf841619?source=api-prod
- 2024-05-22 MEDIUM: Insufficient Authorization Checks to Block Usual (up to 3.9.12). CVE-2024-1803, https://www.wordfence.com/threat-intel/vulnerabilities/id/175e08ce-aec2-427a-90e0-f955711d58b2?source=api-prod
- 2024-05-20 MEDIUM: Arbitrary JavaScript Execution (up to 4.0.2). WF-8ce7aa01-7e79-4048-a84d-fcb9541d5f8b-9, https://www.wordfence.com/threat-intel/vulnerabilities/id/8ce7aa01-7e79-4048-a84d-fcb9541d5f8b?source=api-prod
- 2024-05-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (up to 3.9.16). CVE-2024-4316, https://www.wordfence.com/threat-intel/vulnerabilities/id/2af03168-9344-4db0-9b69-2ad1fdb6d472?source=api-prod
- 2024-04-05 MEDIUM: Missing Authorization (up to 3.9.11). CVE-2024-31274, https://www.wordfence.com/threat-intel/vulnerabilities/id/0ce738ee-bbb6-462a-aeae-0523200e320f?source=api-prod
- 2024-04-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.9.14). CVE-2024-3244, https://www.wordfence.com/threat-intel/vulnerabilities/id/778d8443-fc0f-4e97-8460-e5ceee8b62a1?source=api-prod
- 2024-04-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block (up to 3.9.14). CVE-2024-3245, https://www.wordfence.com/threat-intel/vulnerabilities/id/a427c798-f546-4ca1-98ab-32b433ee5b59?source=api-prod
- 2024-04-05 MEDIUM: Missing Authorization via handle_calendly_data (up to 3.9.8). CVE-2024-31284, https://www.wordfence.com/threat-intel/vulnerabilities/id/be33065e-dae8-44cf-9f8a-f9971f2743ff?source=api-prod
- 2024-03-22 MEDIUM: Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_d (up to 3.9.12). CVE-2024-2688, https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b67927-5993-4e21-af52-8ebe7fee48ab?source=api-prod
- 2024-03-22 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute (up to 3.9.12). CVE-2024-2468, https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3f1310-4d2e-45aa-a3ee-3972a6a31c2e?source=api-prod
- 2024-03-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block (up to 3.9.10). CVE-2024-1802, https://www.wordfence.com/threat-intel/vulnerabilities/id/48511d1a-2fd5-4be4-8409-e99d4aadcdfe?source=api-prod
- 2024-03-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget (up to 3.9.10). CVE-2024-2128, https://www.wordfence.com/threat-intel/vulnerabilities/id/6189368d-5925-4c84-9f0f-694b9ebcd45e?source=api-prod
- 2024-02-14 MEDIUM: Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link (up to 3.9.8). CVE-2024-1425, https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4568c8-f58c-4c37-94b9-6154e5c46928?source=api-prod
- 2024-02-14 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.9.8). CVE-2024-1349, https://www.wordfence.com/threat-intel/vulnerabilities/id/631d200f-7b0b-4105-b91e-030af459ba99?source=api-prod
- 2024-01-02 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (before 3.9.5). CVE-2023-6986, https://www.wordfence.com/threat-intel/vulnerabilities/id/ceae0115-268c-401b-876b-3477d10c10e6?source=api-prod
- 2023-12-08 MEDIUM: Missing Authorization (before 3.9.5). WF-a7cf1c70-9778-4b50-b494-d0b1d0277b35, https://www.wordfence.com/threat-intel/vulnerabilities/id/a7cf1c70-9778-4b50-b494-d0b1d0277b35?source=api-prod
- 2023-11-17 MEDIUM: Reflected Cross-Site Scripting (up to 3.9.1). CVE-2023-5750, https://www.wordfence.com/threat-intel/vulnerabilities/id/41edf49a-18a2-4cf0-b498-738e77287b90?source=api-prod
- 2023-11-17 MEDIUM: Reflected Cross-Site Scripting (up to 3.9.1). CVE-2023-5749, https://www.wordfence.com/threat-intel/vulnerabilities/id/d41fb15c-9e0b-46d2-b60b-4213facc02a7?source=api-prod
- 2023-09-07 MEDIUM: Cross-Site Request Forgery (before 3.8.4). CVE-2023-51375, https://www.wordfence.com/threat-intel/vulnerabilities/id/36ba23ea-7e79-4048-8030-7ed6b2ff45a6?source=api-prod
- 2023-08-09 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data (up to 3.8.2). CVE-2023-4282, https://www.wordfence.com/threat-intel/vulnerabilities/id/5fa2ec9e-2859-4a96-9e33-9e22d37e544f?source=api-prod
- 2023-08-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.8.2). CVE-2023-4283, https://www.wordfence.com/threat-intel/vulnerabilities/id/b340eda1-e9d2-40b6-89f9-41d995ce3555?source=api-prod
- 2023-07-18 MEDIUM: Reflected Cross-Site Scripting via fs_request_get (up to 2.0.2). WF-5253fe2b-040b-417c-b257-0cb59ee5aa6e-709, https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod
- 2023-06-26 MEDIUM: Sensitive Information Exposure (up to 3.7.3). CVE-2023-3371, https://www.wordfence.com/threat-intel/vulnerabilities/id/c1033b4d-82a0-4484-aebf-f35d6a2a9a13?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=embedpress · HTML: https://todaywp.com/plugins/embedpress