CVE-2026-92727 in EmbedPress Plugin
Summary
by MITRE • 10/03/2026
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The slidesShow block attribute is interpolated into an unquoted data-carousel-options HTML attribute, allowing a payload containing spaces to break out of the attribute and inject additional DOM attributes such as onfocus event handlers onto the wrapper element.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The EmbedPress plugin for WordPress, specifically affecting versions up through 4.6.6, contains a critical stored cross-site scripting vulnerability within its slidesShow block attribute functionality. This security flaw stems from insufficient input sanitization and output escaping mechanisms during the processing of user-supplied data. The vulnerability allows authenticated attackers who possess contributor-level access or higher privileges to inject malicious JavaScript code into WordPress pages. Because this is a stored XSS vector, the injected payload persists in the database and executes automatically whenever any user views the compromised page, significantly increasing the potential impact compared to reflected variants that require direct interaction with a crafted link.
The technical root cause lies in how the slidesShow attribute value is rendered within the HTML structure of the embedded content. The plugin interpolates this attribute directly into an unquoted data-carousel-options HTML attribute without proper validation or encoding. This lack of quoting creates a context where special characters, particularly spaces and quotes, can break out of the intended attribute boundary. An attacker can craft a payload that exploits this parsing ambiguity to inject additional DOM attributes onto the wrapper element. Specifically, by injecting event handlers such as onfocus, an attacker can trigger arbitrary script execution under specific user interactions or page loads, effectively bypassing standard security controls designed for data attributes.
From an operational perspective, this vulnerability poses a severe risk to website integrity and user privacy. Once executed, the malicious scripts run in the context of the victim's session with full access to cookies, local storage, and other sensitive site-specific data. Attackers can leverage this capability to perform actions on behalf of authenticated users, steal administrative credentials if an admin visits the page, or redirect visitors to phishing sites designed to harvest login information. The requirement for contributor-level access means that while not trivially exploitable by unauthenticated outsiders, it remains a significant threat in environments where multiple user roles are active and trust boundaries between contributors and administrators may be loosely enforced.
This vulnerability aligns with Common Weakness Enumeration CWE-79, which classifies improper neutralization of input during web page generation as cross-site scripting. The exploitation technique involves manipulating the DOM structure to inject executable code via event handlers, a method often associated with ATT&CK tactic TA0005 Defense Evasion and specifically techniques related to client-side script injection such as T1059.007 Command and Scripting Interpreter: JavaScript or more broadly T1189 Drive-by Client Side Execution when considering the impact on unsuspecting visitors who load the compromised page without realizing they are interacting with malicious content embedded in legitimate-looking media players.
Mitigation strategies should prioritize immediate upgrading to a patched version of the EmbedPress plugin that addresses these sanitization and escaping deficiencies. Administrators must ensure that all plugins remain updated to their latest stable releases, as vendors frequently patch such vulnerabilities following disclosure. In addition to software updates, implementing strict Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby preventing many XSS payloads even if they manage to inject into the DOM. Furthermore, enforcing principle of least privilege is essential; organizations should review user roles and ensure that only trusted individuals with administrative capabilities have access to content creation features that involve embedding complex media blocks like slideshows. Regular security audits and code reviews focusing on input validation in WordPress block attributes can further reduce exposure to similar flaws across the ecosystem.