CVE-2026-85000

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-850016.8The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an CVE-2026-850026.8The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, whi CVE-2026-850044.3The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying CVE-2026-850055.4The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management CVE-2026-850066.8The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting i CVE-2026-850085.3undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the confi CVE-2026-850096.5The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied o CVE-2026-85017.8Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the CVE-2026-850105.3The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added CVE-2026-850128.0Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services cod CVE-2026-850137.3A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a loca CVE-2026-850147.5undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSoc