5.3
Moyenne
CVE-2026-84936 The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action,…
Description
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| EmbedPress 4.6 | 4.6.0 → < 4.6.4 | 4.6.4 |
Autres CVE de EmbedPress
Les 9 CVE de EmbedPress →
CVE-2026-85000
The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated…
5.3
Moyenne
CVE-2026-85001
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before…
6.8
Moyenne
CVE-2026-85002
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an…
6.8
Moyenne
CVE-2026-84927
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google…
2.7
Faible