CVE-2026-85000

UNKNOWN 0.0

EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.

Vendor	unknown
Product	embedpress
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for unknown embedpress

Be the first to know when new unknown vulnerabilities affecting unknown embedpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / EmbedPress

0 < 4.6.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/3c7f7d07-2c46-4839-b97f-27fe41e6292d/

Credits

Alberto Ucendo Martínez WPScan