CVE-2026-85000 is a vulnerability in the EmbedPress WordPress plugin before version 4.6.8. An unauthenticated attacker can trigger a server-side request to a third-party API, consuming the site owner's API quota and writing unbounded records into the site's database. This issue allows for potential API quota consumption and database bloating, impacting site performance and security. Defenders should asses [truncated]
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, allowing users with contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post. This vulnerability requires immediate attention from defenders responsible for WordPress installations with the EmbedPress plugi [truncated]
The EmbedPress WordPress plugin before version 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators. This allows any authenticated user with contributor-level access or above to read the site administrator's email address, a value typically withheld from non-administrative roles in WordPress core. The vulnerability highlights the importance of proper access c [truncated]
