The EmbedPress WordPress plugin in versions 4.4.9 through 4.6.6 fails to sanitize a setting in the Elementor widget before inserting it into an HTML attribute. An attacker with the Contributor role or higher can therefore inject arbitrary JavaScript that is stored with the content. When a user views the affected page, the script runs in that user’s browser, enabling session hijacking, cookie theft, defacement, or other malicious actions that compromise confidentiality, integrity, and availability of the site. The weakness is a classic stored XSS flaw.

The vulnerability affects the EmbedPress plugin for WordPress, specifically all versions from 4.4.9 up to and including 4.6.6. Users who install or use these versions on their sites are potentially impacted. The vulnerability is tied to the Elementor widget component of the plugin.

Any local Contributor or higher can craft the malicious content through the WordPress admin interface, so the attack does not require additional authentication beyond legitimate plugin usage. The stored nature of the flaw means the payload persists across page loads for all viewers, magnifying its impact. While the EPSS score is <1% and the vulnerability is not listed in KEV, the lack of sanitization suggests a high risk if attackers target sites that use the affected plugin version. The CVSS score is 6.8, reflecting the ability to execute arbitrary scripts on page view.