The EmbedPress WordPress plugin before version 4.6.7 fails to escape a block attribute when rendering the content of an Instagram Carousel block. This flaw allows users who have at least the contributor role to insert arbitrary JavaScript into a post that is stored in the database. When higher‑privileged users view that post, the injected script runs in their browser context, potentially enabling credential theft, session hijacking, or other malicious actions typical of stored XSS.

The vulnerability affects the EmbedPress WordPress plugin with any version below 4.6.7 deployed on a WordPress site. Any site using this plugin that allows contributors or higher to add or edit posts is at risk.

The flaw can be exploited by any contributor or higher role on the site and does not require authentication to the target server beyond the credential that grants that role. The lack of escaping in an HTML attribute means the victim is presented with a script that executes automatically when they view the page. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the nature of the attack is severe due to the potential for compromising privileged accounts. Attackers who gain contributor-level access can embed malicious code that will be executed for all users who view the affected posts.