2.7
Faible
CVE-2026-84927 The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google…
Description
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| EmbedPress 4.6 | 4.6.0 → < 4.6.4 | 4.6.4 |
Autres CVE de EmbedPress
Les 9 CVE de EmbedPress →
CVE-2026-85000
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated…
5.3
Moyenne
CVE-2026-85001
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before…
6.8
Moyenne
CVE-2026-85002
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an…
6.8
Moyenne
CVE-2026-84936
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action,…
5.3
Moyenne