Embed Privacy Vulnerabilities

The Embed Privacy plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the [function-name] function in all versions up to, and including, 1.12.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on...

CVSS:

8.1

Affected:

up to 1.12.3

Fixed in:

1.12.4

Disclosed:

Jun 29, 2026

CVE-2026-57346 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affects Embed Privacy: from n/a through 1.8.0.

Affected:

up to 1.8.1

Fixed in:

1.8.1

Disclosed:

Feb 1, 2024

CVE-2023-51694 on NVD →

[en] The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

Affected:

up to 1.8.1

Fixed in:

1.8.1

Disclosed:

Nov 20, 2023

CVE-2023-48300 on NVD →

The Embed Privacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embed_privacy_opt_out ' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers w...

CVSS:

5.4

Affected:

up to 1.8.0

Fixed in:

1.8.1

Disclosed:

Nov 18, 2023

CVE-2023-48300 on NVD →