CVE-2026-7796

MediumCVSS 6.4/10Last modified Jul 23, 2026

Description

The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
wpdevteam	EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more	<= 4.5.3

References

Timeline

Published: Jun 6, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-779605.3Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subs CVE-2026-779668.8The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenti CVE-2026-779678.1The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association wit CVE-2026-779688.2A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Wh CVE-2026-77977.5The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL In CVE-2026-779705.9Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated CVE-2026-779729.0Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach intern CVE-2026-779748.0After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through CVE-2026-779756.5The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. CVE-2026-779778.1Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative acti CVE-2026-77985.4The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vuln CVE-2026-779879.8A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer va