CVE-2026-7796

The EmbedPress plugin for WordPress contains a security flaw affecting all versions up to 4.5.3. The issue arises from inadequate filtering of input data when handling the 'url' attribute within certain blocks, allowing malicious users with contributor-level access or higher to embed executable code on vulnerable pages that will run whenever those pages are accessed by other users.

Based on public CVE data (MITRE/NVD).