EmbedPress Vulnerability– Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-1349 |WordPress Plugin Vulnerability Report 

Plugin Name: EmbedPress

Key Information:

  • Software Type: Plugin
  • Software Slug: embedpress
  • Software Status: Active
  • Software Author: wpdevteam
  • Software Downloads: 2,184,657
  • Active Installs: 80,000
  • Last Updated: February 16, 2024
  • Patched Versions: 3.9.9
  • Affected Versions: <= 3.9.8

Vulnerability Details:

  • Name: EmbedPress <= 3.9.8
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1349
  • CVSS Score: 6.4
  • Publicly Published: February 14, 2024
  • Researcher: Richard Telleng (stueotue)
  • Description: The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin's shortcode(s) in versions up to and including 3.9.8. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages. These scripts execute whenever a user accesses an injected page.


The EmbedPress plugin for WordPress has a vulnerability in versions up to and including 3.9.8 that allows for Stored Cross-Site Scripting via shortcode. This vulnerability has been patched in version 3.9.9.

Detailed Overview:

This vulnerability, discovered by Richard Telleng, lies within the shortcode handling functionality of the EmbedPress plugin. Specifically, it stems from the lack of proper sanitization and escaping of user-supplied input. Attackers with at least contributor-level access to a WordPress site can exploit this flaw to embed malicious scripts in content. When other users, including site visitors, access the compromised content, the embedded scripts execute, potentially leading to unauthorized actions or data exposure. The patched version 3.9.9 addresses this critical issue.

Advice for Users:

Immediate Action: Users of the EmbedPress plugin should immediately update to the patched version 3.9.9 to mitigate the vulnerability. Check for Signs of Vulnerability: Monitor your site for unusual content or behavior, particularly in posts or pages where shortcodes are used, as these may indicate compromise. Alternate Plugins: While the vulnerability has been patched, users may consider exploring other reputable plugins offering similar functionality, especially if they have specific security concerns or requirements. Stay Updated: Regularly update all WordPress core software, themes, and plugins to their latest versions to protect against known vulnerabilities.


The rapid response of the EmbedPress development team in releasing a patch underscores the critical nature of maintaining updated software. To safeguard WordPress installations against potential threats, users should ensure their sites run version 3.9.9 or later of the EmbedPress plugin.


In today's digital age, maintaining the security of your website is not just a recommendation; it's a necessity. The recent discovery of a significant vulnerability in the popular WordPress plugin, EmbedPress, serves as a stark reminder of the risks lurking in the digital shadows. EmbedPress, a versatile plugin allowing users to embed PDFs, YouTube videos, Google Docs, and more into their WordPress sites, has been a go-to tool for over 80,000 websites. However, the revelation of an authenticated stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.9.8 has raised alarms across the WordPress community.

Plugin Overview:

EmbedPress enriches WordPress sites by enabling users to seamlessly integrate various media types into their content. Developed by wpdevteam, this plugin has seen over 2 million downloads, highlighting its popularity and widespread use. The issue was rectified in version 3.9.9, but the vulnerability's presence in all previous versions up to 3.9.8 poses a significant risk.

Vulnerability Insights:

The vulnerability, identified as CVE-2024-1349, was uncovered by researcher Richard Telleng. It specifically targets the plugin's shortcode handling, where insufficient input sanitization and output escaping allow attackers with contributor-level access to inject harmful scripts. These scripts can execute unwanted actions or expose sensitive data when accessed by unsuspecting users, posing a grave threat to website integrity and user security.

Risks and Impacts:

The primary risk of this XSS vulnerability lies in its potential to compromise site integrity and user safety. Malicious scripts can lead to unauthorized data access, manipulation of site content, and even redirection to harmful sites, undermining the trust and reliability of affected websites.

Remediation Strategies:

Immediate action is required to mitigate this vulnerability. Users must update to the patched version 3.9.9 without delay. Additionally, monitoring for unusual site behavior and content is advised to identify potential compromises. While the patch addresses this specific issue, exploring alternative plugins and maintaining a rigorous update routine for all site components can further bolster security.

Historical Context:

This is not the first time EmbedPress has faced security challenges; there have been 10 vulnerabilities reported since June 2023. This pattern underscores the critical nature of ongoing vigilance and the importance of swift developer responses to emerging threats.


For small business owners juggling numerous responsibilities, staying ahead of such vulnerabilities might seem daunting. Yet, the security of your digital presence is integral to your business's credibility and success. Leveraging managed WordPress hosting services, employing security plugins, and subscribing to vulnerability alert services can significantly reduce the burden of constant vigilance. Remember, in the realm of cybersecurity, an ounce of prevention is worth a pound of cure. Ensuring your WordPress site, along with its themes and plugins, are up-to-date is not just about accessing the latest features; it's a critical defense strategy against the ever-evolving landscape of cyber threats.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

EmbedPress Vulnerability– Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-1349 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment