CVE-2024-1565

The EmbedPress plugin for WordPress up to version 3.9.10 contains a stored cross-site scripting vulnerability in its PDF Widget URL functionality caused by inadequate sanitization of user input and escaping of output attributes. Attackers with at least contributor-level permissions can inject malicious scripts into pages through this flaw. When other users visit pages containing the injected code, the scripts execute in their browsers, potentially compromising site security and user data.

Based on public CVE data (MITRE/NVD).