CVE-2026-92727

Name of the Vulnerable Software and Affected Versions EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress versions prior to 4.6.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. The slidesShow block attribute is interpolated into an unquoted data-carousel-options HTML attribute, which allows a payload containing spaces to break out of the attribute and inject additional DOM attributes, such as onfocus event handlers, onto the wrapper element.

Recommendations Update the plugin to version 4.6.7 or later.