CVE-2026-89330: EmbedPress WordPress Plugin XSS Vulnerability

CVE-2026-89330 Overview

CVE-2026-89330 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the EmbedPress WordPress plugin. The flaw affects all versions up to and including 4.6.5. Attackers can inject arbitrary web scripts through the unique parameter due to insufficient input sanitization and output escaping. This is a regression introduced during a refactor: the esc_url() wrapper that remediated the equivalent CVE-2023-5749 in version 3.9.2 was removed in version 4.3.0 when the unique parameter was added. Unauthenticated attackers can exploit the vulnerability by tricking a user into clicking a crafted link.

Critical Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's browser session, enabling session theft, credential harvesting, and administrative account compromise on WordPress sites running the plugin.

Affected Products

EmbedPress WordPress plugin versions up to and including 4.6.5
All installations that upgraded from 4.3.0 onward where the esc_url() wrapper regression was introduced
WordPress sites using the PDF Embedder, 3D PDF FlipBook, Google Reviews, and YouTube Videos embed features of the plugin

Discovery Timeline

2026-09-18 - CVE-2026-89330 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-89330

Vulnerability Analysis

The vulnerability resides in the Feature_Enhancer.php class of the EmbedPress plugin. User-controlled input passed through the unique parameter is reflected into rendered HTML output without proper sanitization or escaping. When a victim visits a specially crafted URL, the injected script executes in their browser under the origin of the vulnerable WordPress site. Because the attack requires user interaction and crosses a security boundary, the impact scope is changed. Reflected XSS in a WordPress context typically enables session hijacking, forced administrative actions through CSRF chaining, and defacement.

Root Cause

The root cause is a regression during code refactoring. The original fix for CVE-2023-5749 in version 3.9.2 applied the WordPress esc_url() function to sanitize URL-like inputs. During the version 4.3.0 refactor that introduced the unique parameter, the esc_url() wrapper was removed from the affected code paths. The vulnerable sinks are documented at lines 1642, 1737, and 1745 of Feature_Enhancer.php in the 4.6.5 release.

Attack Vector

Exploitation is remote and network-accessible. An attacker crafts a URL to a page rendered by the vulnerable plugin, embedding malicious JavaScript in the unique query parameter. The attacker delivers the link through phishing, forum posts, or malicious advertising. When a victim clicks the link, the plugin echoes the parameter into the page response, and the browser executes the injected script. No authentication is required from the attacker, and the payload runs with the privileges of whichever user follows the link.

See the Wordfence Vulnerability Report and the EmbedPress Changeset Analysis for technical details on the vulnerable sinks.

Detection Methods for CVE-2026-89330

Indicators of Compromise

Web server access logs containing requests with unique= parameters that include URL-encoded HTML tags, <script> payloads, javascript: URIs, or event handler attributes such as onerror= and onload=
Referer headers originating from external phishing or link-shortening domains that terminate at pages served by the EmbedPress plugin
Unexpected administrative actions in WordPress audit logs shortly after a session interacted with an EmbedPress-rendered page

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns in query parameters targeting known EmbedPress endpoints
Monitor for outbound requests from browser sessions to unusual domains that could indicate data exfiltration from injected scripts
Correlate authentication and privilege-change events with preceding requests to pages using EmbedPress shortcodes

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end and retain logs long enough to reconstruct attack chains
Implement Content Security Policy (CSP) headers and alert on CSP violation reports
Track plugin version inventory across WordPress deployments to identify hosts still running 4.6.5 or earlier

How to Mitigate CVE-2026-89330

Immediate Actions Required

Update the EmbedPress plugin to a version above 4.6.5 that restores the esc_url() wrapper on the unique parameter
Audit WordPress administrator sessions and force credential rotation for accounts that browsed EmbedPress pages during the exposure window
Deploy WAF signatures that block XSS payloads targeting the unique query parameter

Patch Information

A fix is available in the EmbedPress plugin release following version 4.6.5. Site administrators should apply the update through the WordPress plugin dashboard or by pulling the patched release from the WordPress plugin repository. Review the EmbedPress Changeset Analysis to confirm the restored sanitization on lines 1642, 1737, and 1745 of Feature_Enhancer.php.

Workarounds

Temporarily deactivate the EmbedPress plugin until the patched version is deployed
Configure a strict Content Security Policy that disallows inline scripts on pages rendering EmbedPress content
Add server-side rewrite rules that reject requests containing suspicious characters in the unique parameter

bash

# Example nginx rule to block XSS payloads in the 'unique' parameter
if ($args ~* "unique=[^&]*(<|%3C|script|javascript:|onerror|onload)") {
    return 403;
}