Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities and weaknesses associated with EmbedPress, specifically targeting its PDF embedder, video embedding, and flipbook features. The collection aggregates publicly disclosed security issues affecting this WordPress plugin, which allows users to integrate PDFs, YouTube videos, 3D flipbooks, social feeds, and documents into their websites. This resource covers a wide range of security defects found within the product’s codebase and third-party dependencies, ensuring a comprehensive view of the plugin’s security posture over time. Here, you can track vendor advisories to stay informed about patches and updates, understand the nature of specific weakness classes such as cross-site scripting or path traversal that may impact similar applications, and look up the product’s vulnerability history to assess risk exposure. By consolidating these data points, the page serves as a reference for security professionals, developers, and website administrators who rely on EmbedPress. It enables users to verify whether their installation is affected by known issues, evaluate the vendor’s response time, and understand the potential impact of each disclosed flaw on their digital infrastructure. The information presented is derived from official advisories, bug trackers, and community reports, providing a factual basis for security decision-making without speculation. This centralized view helps streamline the process of monitoring plugin security, allowing stakeholders to prioritize remediation efforts based on severity and relevance to their specific use cases.

Vendor: wpdevteam

CVE IDTitleCVSSSeverityPublished
CVE-2024-11203 EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name' CWE-79 6.4 Medium2024-11-28
CVE-2024-1565 EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL CWE-79 6.4 Medium2024-06-13
CVE-2024-5571 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget CWE-79 6.4 Medium2024-06-05
CVE-2024-1803 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual CWE-285 4.3 Medium2024-05-23
CVE-2024-4316 EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter CWE-79 6.4 Medium2024-05-09
CVE-2024-3244 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 6.4 Medium2024-04-09
CVE-2024-3245 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block CWE-79 6.4 Medium2024-04-06
CVE-2024-2468 EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute CWE-79 6.4 Medium2024-03-23
CVE-2024-2688 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color' CWE-79 5.4 Medium2024-03-23
CVE-2024-1802 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block CWE-79 6.4 Medium2024-03-07
CVE-2024-2128 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget CWE-79 6.4 Medium2024-03-07
CVE-2024-1349 EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 6.4 Medium2024-02-20
CVE-2024-1425 EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link CWE-79 6.4 Medium2024-02-20
CVE-2023-6986 EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 6.4 Medium2024-01-03
CVE-2023-4282 EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data CWE-862 5.4 Medium2023-08-10
CVE-2023-4283 EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CWE-79 6.4 Medium2023-08-10
CVE-2023-3371 EmbedPress <= 3.7.3 - Sensitive Information Exposure CWE-321 5.3 Medium2023-06-27

All 17 known CVE vulnerabilities affecting EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more with full Chinese analysis, references, and POCs where available.