CVE-2026-85002

MediumCVSS 6.8/10Last modified Sep 28, 2026

Description

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 27, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-850044.3The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying CVE-2026-850055.4The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management CVE-2026-850066.8The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting i CVE-2026-850085.3undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the confi CVE-2026-850096.5The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied o CVE-2026-85017.8Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the CVE-2026-850105.3The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added CVE-2026-850128.0Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services cod CVE-2026-850137.3A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a loca CVE-2026-850147.5undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSoc CVE-2026-850156.6The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting CVE-2026-850166.8The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attri