Embedpress
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:embedpress:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Embedpress (4603c915-98de-5ddb-ae12-a3a98f54337b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-84936 |
vulnerable | 2026-09-16 04:33:10.686515 |
EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Published: 2026-09-05T06:00:10.456Z
Updated: 2026-09-06T10:23:48.136Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84926 |
vulnerable | 2026-09-16 04:33:10.664282 |
EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
Published: 2026-09-05T06:00:09.423Z
Updated: 2026-09-06T10:36:10.643Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84927 |
vulnerable | 2026-09-16 04:33:10.627329 |
EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.
Published: 2026-09-05T06:00:09.596Z
Updated: 2026-09-06T10:35:56.156Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10526 |
vulnerable | 2026-09-16 04:32:43.444818 |
EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).
Published: 2026-08-04T06:00:09.155Z
Updated: 2026-08-04T14:35:05.449Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5750 |
vulnerable | 2026-06-08 06:19:44.618896 |
EmbedPress < 3.9.2 - Reflected XSS
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Published: 2023-12-11T19:22:38.813Z
Updated: 2024-08-02T08:07:32.676Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5749 |
vulnerable | 2026-06-08 06:19:44.617881 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.