CVE-2026-92727

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The slidesShow block attribute is interpolated into an unquoted data-carousel-options HTML attribute, allowing a payload containing spaces to break out of the attribute and inject additional DOM attributes such as onfocus event handlers onto the wrapper element.

• CWE-79

• https://plugins.trac.wordpress.org/browser/embedpress/tags/4.6.6/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php#L1105
• https://plugins.trac.wordpress.org/browser/embedpress/tags/4.6.6/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php#L1114
• https://plugins.trac.wordpress.org/browser/embedpress/tags/4.6.6/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php#L1549
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e2a22349-caa7-4756-ad2f-1861ccff6c30?source=cve

Published

Oct 3, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92716Shuffle through 2.2.1 contains a cross-tenant privilege esca…9.6
• CVE-2026-92717Covenant through 0.6 registers the CovenantHub SignalR hub w…9.1
• CVE-2026-92718Nuclei versions before 3.11.1 cache template signature verif…7.3
• CVE-2026-92719Quickwit through 0.9.0 fails to validate the host and scheme…7.5
• CVE-2026-9272In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5,…8.1
• CVE-2026-92720Kubero through 3.1.1 fails to apply authentication guards to…9.1
• CVE-2026-92729SigNoz versions 0.88.0 through 0.141.0 fail to apply authori…8.2
• CVE-2026-9273The Membership Plugin – Kadence Memberships plugin for WordP…9.3
• CVE-2026-92730LimeSurvey Community Edition 7.0.14 contains a reflected cro…7.4
• CVE-2026-9274This vulnerability exists in CP Plus Wi-Fi Camera due to imp…5.2
• CVE-2026-92744Under certain conditions, privilege manager agent allows a r…8.7
• CVE-2026-92745A flaw was found in cockpit-machines. This vulnerability all…5