EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'

Vulnerability

The EmbedPress plugin for WordPress (versions up to and including 4.1.3) contains a Stored Cross-Site Scripting vulnerability in the provider_name parameter. Insufficient input sanitization and output escaping allow authenticated users with at least Contributor-level access to inject arbitrary web scripts.

Exploitation

An attacker with a Contributor-level account or higher can inject malicious JavaScript into the provider_name parameter. When a user (including administrators) views the page containing the embedded block, the injected script executes in the context of the victim's browser.

Impact

Successful exploitation leads to arbitrary script execution, potentially allowing the attacker to perform actions such as cookie theft, session hijacking, or defacement on the affected WordPress site. The attacker does not require elevated privileges beyond Contributor.

Mitigation

The vulnerability is fixed in version 4.5.3 or later of EmbedPress [1]. Users should update the plugin immediately. If updating is not possible, restrict Contributor-level user accounts and review any embedded content for malicious input.