CVE-2026-85001: EmbedPress WordPress Plugin XSS Vulnerability

CVE-2026-85001 Overview

CVE-2026-85001 is a stored Cross-Site Scripting (XSS) vulnerability in the EmbedPress WordPress plugin affecting versions before 4.6.7. The plugin fails to sanitize and escape one of its Elementor widget settings before rendering it inside an HTML attribute. Authenticated users with the Contributor role or higher can inject arbitrary JavaScript that executes when other users view the affected content. The flaw enables session theft, privilege escalation through admin interaction, and defacement of published pages.

Critical Impact
Contributor-level attackers can persist JavaScript payloads in Elementor widgets, executing scripts in the browsers of editors, administrators, and site visitors.

Affected Products

EmbedPress WordPress plugin versions prior to 4.6.7
WordPress sites using EmbedPress with the Elementor page builder
Multi-author WordPress deployments allowing Contributor-level accounts

Discovery Timeline

2026-09-30 - CVE-2026-85001 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-85001

Vulnerability Analysis

EmbedPress extends the Elementor page builder with widgets that embed third-party media and content. One of these widgets exposes a setting that is written directly into an HTML attribute in the rendered output. The plugin does not run this value through WordPress escaping helpers such as esc_attr() before output. An attacker who can edit a post or page and configure an EmbedPress widget can therefore break out of the attribute context by supplying crafted quote characters and event handlers.

Because the injected markup is persisted with the post content, every request that renders the page delivers the payload. Execution occurs in the origin of the WordPress site, giving the attacker access to authenticated session cookies, the WordPress REST API, and any DOM state available to logged-in users viewing the content.

Root Cause

The root cause is missing output encoding [CWE-79]. The Elementor widget renderer concatenates a user-supplied setting into an HTML attribute value without applying context-appropriate escaping. WordPress provides esc_attr() and esc_url() for this purpose, but neither is invoked on the affected setting in versions before 4.6.7.

Attack Vector

Exploitation requires an authenticated account with the Contributor role or higher. The attacker edits a post, inserts the vulnerable EmbedPress Elementor widget, and supplies a value containing a quote character followed by an HTML event handler such as onmouseover or onload. When an editor previews the draft or an administrator reviews the submission for publication, the payload executes in their browser. Refer to the WPScan Vulnerability Advisory for reproduction details.

The vulnerability is described in prose only; no verified proof-of-concept code is published in the advisory referenced by NVD.

Detection Methods for CVE-2026-85001

Indicators of Compromise

Post or page revisions authored by Contributor accounts containing EmbedPress Elementor widgets with unusual attribute values or HTML event handlers
Outbound requests from editor or admin browsers to unfamiliar domains after opening the WordPress admin dashboard
New administrator accounts, modified user roles, or altered wp_options records following Contributor content submissions

Detection Strategies

Query the wp_posts table for serialized Elementor data containing strings such as onerror=, onload=, javascript:, or unescaped " characters within EmbedPress widget settings
Review WordPress audit logs for Contributor-role users who create or edit posts using EmbedPress widgets
Monitor browser Content Security Policy (CSP) violation reports for inline script executions on pages built with Elementor

Monitoring Recommendations

Alert on installations of EmbedPress at versions below 4.6.7 across managed WordPress fleets
Track privilege changes to WordPress user accounts within 24 hours of Contributor post submissions
Log and review all administrator sessions that render draft posts submitted by lower-privilege users

How to Mitigate CVE-2026-85001

Immediate Actions Required

Upgrade the EmbedPress plugin to version 4.6.7 or later on every WordPress site in scope
Audit existing posts and pages for EmbedPress widget settings containing suspicious characters or event handlers, and remove them
Review the Contributor and Author user lists and suspend accounts that are no longer required

Patch Information

The vendor addressed the vulnerability in EmbedPress 4.6.7 by applying proper output escaping to the affected Elementor widget setting. Site owners should update through the WordPress plugin manager or by deploying the fixed release from the plugin repository. See the WPScan Vulnerability Advisory for the full advisory record.

Workarounds

Temporarily restrict Contributor and Author accounts from using EmbedPress Elementor widgets until patching is complete
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to wp-admin/admin-ajax.php and Elementor endpoints containing HTML event-handler patterns
Enforce a strict Content Security Policy that disallows inline scripts and unsafe event handlers on rendered pages

bash

# Configuration example: upgrade EmbedPress using WP-CLI
wp plugin update embedpress --version=4.6.7
wp plugin list --name=embedpress --fields=name,status,version