Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: EmbedPress 4.6.4 Clear all filters
TI-2026-58377 CVE-2026-84936 · GHSA-5cvh-x6xg-5fhw

EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat

Priority LOW 30

The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-09-05 Fixed in 4.6.4 CWE-284
TI-2026-58371 CVE-2026-84927 · GHSA-6rmc-pw7c-rvpw

EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification

Priority LOW 13

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store,…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00281 Published 2026-09-05 Fixed in 4.6.4 CWE-862
TI-2026-58370 CVE-2026-84926 · GHSA-v7h4-fj7g-j5pv

EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route

Priority LOW 13

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read t…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00316 Published 2026-09-05 Fixed in 4.6.4 CWE-200