Jangwoo Choi

The EmbedPress plugin for WordPress is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. The issue occurs due to insufficient input sanitization and output escaping within the `url` attribute of the block. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

The issue is related to a URL redirection to an untrusted site, also known as an 'Open Redirect' vulnerability, in the file access component. This allows remote authenticated users to conduct phishing attacks via unspecified vectors.