CVE-2023-5749

The EmbedPress plugin for WordPress prior to version 3.9.2 contains a reflected cross-site scripting vulnerability in the password parameter that affects all versions through 3.9.1. The flaw stems from inadequate sanitization of user input and failure to properly escape output, allowing unauthenticated attackers to inject malicious scripts that execute when users click a crafted link. This vulnerability can be exploited to run arbitrary code in the context of a victim's browser session.

Based on public CVE data (MITRE/NVD).