Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more
Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.3.10.
CVE-2025-31784Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more <= 1.4.0 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more
Author
Rudy Susanto
This plugin allows you to embed external sites that are not supported by the built-in WordPress embed feature. It fetches information from the site’s embed API, oEmbed endpoint and Open Graph tags. It will also parse the content manually if such information cannot be found. Usage Just copy-and-paste the URL into your favorite WordPress post editor to trigger the embed fetching function. It integrates seamlessly with the Gutenberg editor, Elementor, classic editor, the embed shortcode, and also programmatically, so you don’t have to set up anything to get it working. Features No setup needed. Activate and it should work right away. Non-intrusive. This plugin will not replace embed for sites already supported by the built-in WordPress embed feature or other plugins (e.g., Jetpack). Responsive. Embed cards will adjust to the available space. Extendable template. The default embed card template can be extended to get a different look. Supported content types Content types below are supported by the plugin: Any web pages. Any source code and configuration file links (js, css, php, py, rb, ini, conf, etc). Any video links (mp4, m4v, webm, ogv, flv). Any audio links (mp3, ogg, flac, m4a, wav). Any PDF document links. This plugin also improves support for the following content providers: GitHub source codes and snippets/gists. GitLab source codes. Google Maps places, directions, street views, search results, and area maps. Twitch videos, channel, and collections. Waze livemap. Wistia videos and playlists.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C