What is GHSA-ch5r-8r2c-893j?

GHSA-ch5r-8r2c-893j is a security advisory published by GitHub Security Advisories with Medium severity. The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before...

Which CVE IDs does GHSA-ch5r-8r2c-893j cover?

GHSA-ch5r-8r2c-893j covers the following CVE IDs: CVE-2026-85002. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ch5r-8r2c-893j?

GHSA-ch5r-8r2c-893j has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-ch5r-8r2c-893jMediumCVSS 6.8

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before...

Vendor

GitHub Security Advisories

Published

September 27, 2026

Last Modified

September 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-85002 →

📋 Description

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-85002
https://wpscan.com/vulnerability/ad155ea2-c804-4906-956e-e2da8050d0de
https://github.com/advisories/GHSA-ch5r-8r2c-893j