CVE-2026-7796: EmbedPress WordPress Plugin XSS Vulnerability

CVE-2026-7796 Overview

CVE-2026-7796 is a Stored Cross-Site Scripting (XSS) vulnerability in the EmbedPress plugin for WordPress. The plugin, which provides PDF embedding, YouTube video integration, 3D FlipBook, and social feed functionality, fails to properly sanitize and escape the block url attribute. All versions up to and including 4.5.3 are affected. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when visitors view an affected page. The flaw is tracked as [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser context of any user, including administrators, viewing the affected page.

Affected Products

EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress
All versions up to and including 4.5.3
WordPress installations with contributor-or-higher user registration enabled

Discovery Timeline

2026-06-06 - CVE-2026-7796 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-7796

Vulnerability Analysis

The vulnerability resides in the EmbedPress Gutenberg block renderer. When the plugin processes the url attribute supplied via a block, it passes the value through to the rendered page without sufficient sanitization on input or escaping on output. An authenticated attacker with contributor permissions can craft a block whose url attribute contains JavaScript or HTML payloads. The payload is stored in the post content and rendered to every subsequent viewer of the page.

Because the script executes in the context of the WordPress site origin, attackers can hijack administrator sessions, perform actions on behalf of the logged-in user, exfiltrate cookies, or pivot to plugin and user management endpoints. The scope change in the impact metrics reflects the ability to affect resources beyond the attacker's own privilege boundary.

Root Cause

The root cause is insufficient input sanitization and missing output escaping in the EmbedPress block renderer and its helper class. Specifically, the code paths referenced in EmbedPress/Gutenberg/EmbedPressBlockRenderer.php and EmbedPress/Includes/Classes/Helper.php accept and emit the url attribute without applying WordPress escaping functions such as esc_url() or esc_attr() prior to output.

Attack Vector

An attacker first obtains contributor-level credentials on the target WordPress site. The attacker then creates or edits a post that includes an EmbedPress block and sets the block's url attribute to a payload that breaks out of the expected URL context. When the post is published or previewed by another user, the stored payload executes in that user's browser. Exploitation requires no user interaction beyond visiting the page containing the malicious block.

See the Wordfence Vulnerability Report and the WordPress EmbedPress Block Renderer source for technical details of the affected code paths.

Detection Methods for CVE-2026-7796

Indicators of Compromise

Post or page content containing EmbedPress block markup with url attributes that include javascript:, <script>, or HTML event handlers such as onerror= and onload=.
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after viewing posts containing EmbedPress blocks.
New administrator accounts, modified user roles, or unauthorized plugin installations following contributor activity on the site.

Detection Strategies

Scan the wp_posts table for block markup matching the EmbedPress namespace and inspect stored url attribute values for script payloads or non-URL content.
Review web server access logs for POST requests to /wp-admin/post.php and /wp-json/wp/v2/ endpoints originating from contributor accounts that include EmbedPress block payloads.
Use a Content Security Policy (CSP) in report-only mode to surface inline script execution and unexpected script sources on pages rendering EmbedPress content.

Monitoring Recommendations

Audit contributor and author accounts for recent post creation or revision activity, especially posts that use EmbedPress blocks.
Monitor WordPress audit logs for plugin or theme modifications, role changes, and option updates that follow page views by privileged users.
Alert on browser-side anomalies such as cookie access, form modification, or redirect behavior in administrator sessions.

How to Mitigate CVE-2026-7796

Immediate Actions Required

Update the EmbedPress plugin to the version following 4.5.3 that addresses this issue, as referenced in the WordPress EmbedPress changeset.
Audit all contributor, author, and editor accounts and remove any that are unrecognized or inactive.
Review recently created or edited posts containing EmbedPress blocks and remove malicious url attribute values.

Patch Information

The vendor addressed the issue in a release subsequent to 4.5.3. Site administrators should apply the latest available EmbedPress update through the WordPress plugins dashboard. Patch references are available via the WordPress EmbedPress changeset and the Wordfence Vulnerability Report.

Workarounds

Restrict contributor-level and higher account creation, and require manual approval for new user registrations until patching is complete.
Temporarily deactivate the EmbedPress plugin on sites where contributor accounts are widely provisioned and the update cannot be applied immediately.
Deploy a Web Application Firewall (WAF) rule that inspects post submissions for EmbedPress block payloads containing script tags or javascript: URIs.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.

bash

# Configuration example: update EmbedPress via WP-CLI and audit recent posts
wp plugin update embedpress
wp post list --post_status=publish,draft,pending --format=ids \
  | xargs -I {} wp post get {} --field=post_content \
  | grep -E 'wp:embedpress|url":"[^"]*(javascript:|<script|onerror=|onload=)'