EmbedPress vulnerabilities | LiveThreat CVE Feed

Product

EmbedPress

by WPDeveloper · last CVE Aug 6, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities28 In the news0 Timeline

Severity mix

Critical 2High 5Medium 21Low 0

Severity

All severities28 Critical2 High5 Medium21 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add EmbedPress to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-43328	9.8	0%	Aug 19	WordPress EmbedPress plugin <= 4.0.9 - Local File Inclusion vulnerability Affected: through 4.0.9
CVE-2024-31284	9.8	0%	Jun 9	WordPress EmbedPress plugin <= 3.9.8 - Broken Access Control vulnerability Affected: through 3.9.8
CVE-2024-38707	8.8	0%	Nov 1	WordPress EmbedPress plugin <= 4.0.4 - Broken Access Control vulnerability Affected: through 4.0.4
CVE-2023-51375	8.8	0%	Jun 21	WordPress EmbedPress plugin <= 3.8.3 - Broken Access Control vulnerability Affected: through 3.8.3
CVE-2026-48872	7.5	0%	Jun 15	WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability Affected: through 4.5.2
CVE-2023-3371	7.5	1%	Jun 27	EmbedPress <= 3.7.3 - Sensitive Information Exposure Affected: through 3.7.3
CVE-2026-61961	7.1	0%	Aug 6	WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability Affected: through 4.5.6
CVE-2023-5749	6.1	0%	Dec 11	EmbedPress < 3.9.2 - Reflected XSS Affected: before 3.9.2
CVE-2023-5750	6.1	0%	Dec 11	EmbedPress < 3.9.2 - Reflected XSS Affected: before 3.9.2
CVE-2024-11203	5.4	0%	Nov 28	EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name' Affected: before 4.1.4
CVE-2024-50461	5.4	0%	Oct 28	WordPress EmbedPress plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerability Affected: through 4.0.14
CVE-2024-43936	5.4	0%	Aug 29	WordPress EmbedPress plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability Affected: through 4.0.8
CVE-2024-1565	5.4	0%	Jun 13	EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL Affected: before 3.9.11
CVE-2024-5571	5.4	0%	Jun 5	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget Affected: before 4.0.2
CVE-2024-4316	5.4	0%	May 9	EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter Affected: through 3.9.16
CVE-2024-3244	5.4	1%	Apr 9	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 3.9.14
CVE-2024-3245	5.4	0%	Apr 6	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block Affected: through 3.9.14
CVE-2024-2468	5.4	0%	Mar 23	EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute Affected: through 3.9.12
CVE-2024-2688	5.4	0%	Mar 23	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color' Affected: through 3.9.12
CVE-2024-1802	5.4	0%	Mar 7	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block Affected: through 3.9.10
CVE-2024-2128	5.4	0%	Mar 7	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget Affected: through 3.9.10
CVE-2024-1349	5.4	0%	Feb 20	EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: before 3.9.9
CVE-2024-1425	5.4	1%	Feb 20	EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link Affected: before 3.9.9
CVE-2023-6986	5.4	0%	Jan 3	EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: before 3.9.6
CVE-2023-4283	5.4	1%	Aug 10	EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 3.8.2
CVE-2024-31274	5.3	0%	Jun 9	WordPress EmbedPress plugin <= 3.9.11 - Broken Access Control vulnerability Affected: through 3.9.11
CVE-2024-1803	4.3	0%	May 23	EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual Affected: through 3.9.12
CVE-2023-4282	4.3	1%	Aug 10	EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data Affected: through 3.8.2