Skip to content
Noroxi

EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more

embedpress · plugin

Known security vulnerabilities for EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more. Find out in seconds which version runs on your site with WP Lens.

26 known vulnerabilities

2 critical · latest Sep 18, 2026

Vulnerabilities

  • CVE-2024-43328

    WordPress EmbedPress plugin <= 4.0.9 - Local File Inclusion vulnerability

    Critical 9.8

  • CVE-2024-31284

    WordPress EmbedPress plugin <= 3.9.8 - Broken Access Control vulnerability

    Critical 9.8

  • CVE-2024-38707

    WordPress EmbedPress plugin <= 4.0.4 - Broken Access Control vulnerability

    High 8.8

  • CVE-2023-51375

    WordPress EmbedPress plugin <= 3.8.3 - Broken Access Control vulnerability

    High 8.8

  • CVE-2026-48872

    WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability

    High 7.5

  • CVE-2023-3371

    EmbedPress <= 3.7.3 - Sensitive Information Exposure

    High 7.5

  • CVE-2026-61961

    WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-7796

    EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute

    Medium 6.4

  • CVE-2026-89330

    EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters

    Medium 6.1

  • CVE-2024-50461

    WordPress EmbedPress plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-43936

    WordPress EmbedPress plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2024-1565

    EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL

    Medium 5.4

  • CVE-2024-5571

    EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated

    Medium 5.4

  • CVE-2024-4316

    EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (C

    Medium 5.4

  • CVE-2024-3244

    EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated

    Medium 5.4

  • CVE-2024-3245

    EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated

    Medium 5.4

  • CVE-2024-2688

    EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated

    Medium 5.4

  • CVE-2024-2468

    EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute

    Medium 5.4

  • CVE-2024-1802

    EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated

    Medium 5.4

  • CVE-2024-2128

    EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated

    Medium 5.4

  • CVE-2024-1425

    EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link

    Medium 5.4

  • CVE-2024-1349

    EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2023-6986→ 3.9.5

    EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+

    Medium 5.4

  • CVE-2023-4283

    EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2024-31274

    WordPress EmbedPress plugin <= 3.9.11 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2023-4282

    EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data

    Medium 4.3

← Back to directory