{"schemaVersion":3,"id":"CVE-2026-85001","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The EmbedPress  WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.","dates":{"published":"2026-09-30T06:00:21.776Z","modified":"2026-09-30T13:37:23.863Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":6.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00235,"percentile":0.1348,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-30T00:00:00.000Z","score":0.00152,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00235,"percentile":0.1348}],"last30":[{"date":"2026-09-30T00:00:00.000Z","score":0.00152,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00235,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00235,"percentile":0.1348}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_B7794637359E4400","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/889be882-342b-4331-89c5-9eebe90d3704/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"unknown","product":"embedpress","name":"EmbedPress","label":"embedpress","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.4.9, < 4.6.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.4.9, < 4.6.7","eol":null,"hubHref":"/vendor/unknown/embedpress"},{"vendor":"wordpress","product":"embedpress","name":"EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents","label":"embedpress","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.4.9, ≤ 4.6.6 (fixed in 4.6.7)","noFixRecorded":false,"fixedIn":"4.6.7"}],"versionsText":"≥ 4.4.9, ≤ 4.6.6 (fixed in 4.6.7)","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/889be882-342b-4331-89c5-9eebe90d3704/","label":"wpscan.com/vulnerability/889be882-342b-4331-89c5-9eebe90d3704/","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cac173ab-0f28-4d00-9e4f-f1819d62d92f","label":"www.wordfence.com/threat-intel/vulnerabilities/id/cac173ab-0f28-4d00-9e4f-f1819d62d92f","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-30T06:00:21.776Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-30T13:37:23.863Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":37,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T09:23:07.604Z","stale":false,"partial":false}}