CVE-2026-85001

Published 30 September 2026 · tracked since 30 September 2026

Description

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-94029 MEDIUM 6.5
• CVE-2026-94052 CRITICAL 9.1
• CVE-2026-94053 CRITICAL 9.1
• CVE-2026-77185 CRITICAL 9.1
• CVE-2026-93994 HIGH 8.1
• CVE-2026-93995 MEDIUM 6.5
• CVE-2026-93996 MEDIUM 6.5
• CVE-2026-94002 HIGH 7.5
• CVE-2026-75098 HIGH 7.5
• CVE-2026-97347 HIGH 7.2

→ Open the live CVE board · all tools