---
id: CVE-2026-85002
title: >-
  The EmbedPress  WordPress plugin before 4.6.7 does not escape one of its block
  attributes before outputting it inside an HTML attribute, which could allow
  users with the contributor role and above to perform Stored Cross-Site
  Scripting a…
summary: >-
  The EmbedPress  WordPress plugin before 4.6.7 does not escape one of its block
  attributes before outputting it inside an HTML attribute, which could allow
  users with the contributor role and above to perform Stored Cross-Site
  Scripting a…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
product: EmbedPress
affected:
  - EmbedPress < 4.6.7
published: '2026-09-27'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T16:38:58.950'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85002'
references:
  - url: 'https://wpscan.com/vulnerability/ad155ea2-c804-4906-956e-e2da8050d0de/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-28T00:39:58.811596Z'
ingestedAt: '2026-09-27T06:43:46.829Z'
epss: 0.00262
epssPercentile: 0.17855
---

## Overview

The EmbedPress  WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.