The plugin fails to sanitize and escape the 'url' attribute in Gutenberg blocks, allowing authenticated users with contributor-level privileges to embed malicious scripts. This stored cross‑site scripting flaw means when any other user visits a page containing the injected content, the script runs in their browser. The impact is the ability to steal session cookies, deface content, or perform further client‑side attacks, compromising confidentiality, integrity, and availability of the web application. The weakness is classified as CWE‑79.

WordPress installations running the EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin up to and including version 4.5.3 are affected. The plugin is authored by wpdevteam and is often used to embed media via Gutenberg. Only users with contributor or higher permissions can inject the exploit, so the issue is limited to sites with such role distribution.

The CVSS score of 6.4 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits yet. However, because the attack requires legitimate contributor access, the risk remains high in environments where such users are abundant or have wide editing rights. The vector is likely an authenticated content‑editing session in the WordPress back‑end, possibly through the block editor UI.