Medium severity6.4NVD Advisory· Published Jan 3, 2024· Updated Apr 8, 2026

CVE-2023-6986

Description

The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed_oembed_html shortcode in all versions up to 3.9.5 (exclusive) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpdeveloper/Embedpress
cpe:2.3:a:wpdeveloper:embedpress:*:*:*:*:*:wordpress:*:*
Range: <3.9.6
WordPress/Embedpressllm-fuzzy
Range: <3.9.5
Package: https://wordpress.org/plugins/embedpress

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/ceae0115-268c-401b-876b-3477d10c10e6nvdPatchThird Party Advisory
plugins.svn.wordpress.org/embedpress/trunk/EmbedPress/Shortcode.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000