Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : June 11, 2026

CVE-2026-7796: EmbedPress <= 4.5.3 Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute PoC, Patch Analysis & Rule

CVE ID CVE-2026-7796
Plugin embedpress
Severity Medium (CVSS 6.4)
CWE 79
Vulnerable Version 4.5.3
Patched Version 4.5.4
Disclosed June 4, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-7796: This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages via the EmbedPress plugin for WordPress. The vulnerability is a stored cross-site scripting (XSS) issue affecting the block ‘url’ attribute in all versions up to and including 4.5.3. The CVSS score is 6.4, indicating medium severity.

The root cause is insufficient input sanitization and output escaping in the handling of the ‘url’ attribute within the block editor. The code diff does not directly show the specific block editor code where the vulnerability manifests, but the description from the CVE confirms this as a stored XSS vulnerability. The patch focuses on other areas such as dynamic field resolution, localization, and REST API URL handling, but does not directly address the block editor input sanitization issue. Atomic Edge research indicates that the vulnerability lies in how the plugin processes user-supplied URLs in the Gutenberg block editor, where the ‘url’ attribute from blocks like PDF or document embeds is not properly sanitized before being stored and rendered.

An attacker with contributor-level access can exploit this by creating or editing a post in the block editor. They would insert a vulnerable EmbedPress block, such as the PDF or Document embed block, and set the ‘url’ attribute to a malicious JavaScript payload. The payload could be something like ‘javascript:alert(1)’ or an event handler attribute. When any user, including administrators, views the page, the injected script executes in their browser context. The attack vector is the standard WordPress block editor interface, requiring only the ability to create or edit posts.

The patch primarily addresses other issues, including dynamic field resolution in Elementor widgets, localization improvements, REST URL handling, and hardcoded paths. The specific sanitization fix for the block ‘url’ attribute is not visible in the provided diff, but the general nature of the changes suggests the plugin is hardening input/output handling. The patch adds a new DynamicFieldResolver class and refactors code to use it, which may include improved sanitization. However, the core XSS issue likely requires additional sanitization of the url attribute before display.

If exploited, this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim’s browser. This can lead to session hijacking, cookie theft, phishing attacks, defacement of the WordPress site, or further privilege escalation by executing actions as the compromised user. Since it is stored XSS, the attack persists until the malicious content is removed from the database.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/embedpress/Core/AssetManager.php
+++ b/embedpress/Core/AssetManager.php
@@ -154,7 +154,7 @@
         ],
         'onboarding-js' => [
             'file' => 'js/onboarding.build.js',
-            'deps' => [],
+            'deps' => ['wp-i18n'],
             'contexts' => ['admin'],
             'type' => 'script',
             'footer' => true,
@@ -164,7 +164,7 @@
         ],
         'custom-player-js' => [
             'file' => 'js/custom-player.build.js',
-            'deps' => [],
+            'deps' => ['wp-i18n'],
             'contexts' => ['admin'],
             'type' => 'script',
             'footer' => true,
@@ -600,6 +600,18 @@
                     !empty($asset['footer'])
                 );

+                // Wire up JS translations via the `embedpress` textdomain so
+                // `__('Foo','embedpress')` calls inside React build files
+                // resolve against wp-content/languages/plugins/embedpress-{locale}-{handle}.json.
+                // Applies to every script we register, since the textdomain is shared.
+                if (function_exists('wp_set_script_translations')) {
+                    wp_set_script_translations(
+                        $asset['handle'],
+                        'embedpress',
+                        defined('EMBEDPRESS_PATH_BASE') ? EMBEDPRESS_PATH_BASE . 'languages' : false
+                    );
+                }
+
                 // Add module attribute for ES modules (only build files)
                 if (strpos($asset['file'], '.build.js') !== false) {
                     // Track this handle as a module
--- a/embedpress/Core/LocalizationManager.php
+++ b/embedpress/Core/LocalizationManager.php
@@ -192,6 +192,10 @@
             'twitchHost' => !empty($pars_url['host']) ? $pars_url['host'] : '',
             'twitchSettings' => self::get_twitch_settings(),
             'siteUrl' => site_url(),
+            // Permalink-aware REST base. Plain permalinks serve REST under
+            // ?rest_route=/ instead of /wp-json/, so always derive from
+            // rest_url() rather than concatenating site_url() + '/wp-json/'.
+            'restUrl' => esc_url_raw(rest_url('embedpress/v1/')),
             'activeBlocks' => $active_blocks,
             'documentCta' => $documents_cta_options,
             'pdfRenderer' => Helper::get_pdf_renderer(),
@@ -671,7 +675,11 @@

     public static function init()
     {
-        // Load text domain early
-        add_action('plugins_loaded', [__CLASS__, 'load_text_domain'], 1);
+        // Load directly: init() is called from an `init` priority-5 callback in
+        // Core/init.php, so `plugins_loaded` has already fired and registering a
+        // hook on it here is a no-op. Since WP 4.6 `init` is the recommended
+        // hook for load_plugin_textdomain anyway, and WPML's `gettext` filter
+        // is registered well before this point.
+        self::load_text_domain();
     }
 }
--- a/embedpress/EmbedPress/Analytics/Analytics.php
+++ b/embedpress/EmbedPress/Analytics/Analytics.php
@@ -47,11 +47,21 @@
         wp_enqueue_script(
             'embedpress-analytics',
             EMBEDPRESS_URL_ASSETS . 'js/analytics.build.js',
-            ['wp-element'],
+            ['wp-element', 'wp-i18n'],
             EMBEDPRESS_PLUGIN_VERSION,
             true
         );

+        // Wire JS translations so `__('Foo','embedpress')` in the analytics
+        // bundle resolves against languages/embedpress-{locale}-embedpress-analytics.json.
+        if (function_exists('wp_set_script_translations')) {
+            wp_set_script_translations(
+                'embedpress-analytics',
+                'embedpress',
+                defined('EMBEDPRESS_PATH_BASE') ? EMBEDPRESS_PATH_BASE . 'languages' : false
+            );
+        }
+
         // Add module attribute for ES modules
         add_filter('script_loader_tag', function($tag, $handle) {
             if ($handle === 'embedpress-analytics') {
--- a/embedpress/EmbedPress/Elementor/Embedpress_Elementor_Integration.php
+++ b/embedpress/EmbedPress/Elementor/Embedpress_Elementor_Integration.php
@@ -698,7 +698,7 @@
                             message: formData.get('message')
                         };

-                        fetch('/wp-json/embedpress/v1/send-feedback', {
+                        fetch('<?php echo esc_url_raw(rest_url('embedpress/v1/send-feedback')); ?>', {
                                 method: 'POST',
                                 headers: {
                                     'Content-Type': 'application/json',
@@ -750,7 +750,7 @@
                             message: ''
                         };

-                        fetch('/wp-json/embedpress/v1/send-feedback', {
+                        fetch('<?php echo esc_url_raw(rest_url('embedpress/v1/send-feedback')); ?>', {
                                 method: 'POST',
                                 headers: {
                                     'Content-Type': 'application/json',
@@ -1112,7 +1112,7 @@

                         // Fetch analytics data
                         const nonce = (typeof wpApiSettings !== 'undefined' && wpApiSettings.nonce) ? wpApiSettings.nonce : '<?php echo wp_create_nonce('wp_rest'); ?>';
-                        fetch('/wp-json/embedpress/v1/analytics/overview?date_range=30', {
+                        fetch('<?php echo esc_url_raw(rest_url('embedpress/v1/analytics/overview')); ?>?date_range=30', {
                                 headers: {
                                     'X-WP-Nonce': nonce
                                 }
--- a/embedpress/EmbedPress/Elementor/Widgets/Embedpress_Document.php
+++ b/embedpress/EmbedPress/Elementor/Widgets/Embedpress_Document.php
@@ -7,6 +7,7 @@
 use ElementorModulesDynamicTagsModule as TagsModule;
 use ElementorWidget_Base as Widget_Base;
 use ElementorPlugin;
+use EmbedPressIncludesClassesDynamicFieldResolver;
 use EmbedPressIncludesTraitsBranding;
 use EmbedPressIncludesClassesHelper;

@@ -532,54 +533,10 @@
         $url = esc_url($this->get_file_url());
         $id = 'embedpress-pdf-' . esc_attr($this->get_id());

-        if ($settings['embedpress_document_type'] === 'url') {
-            if (!empty($settings['__dynamic__']['embedpress_document_file_link'])) {
-                $decode_url = urldecode($settings['__dynamic__']['embedpress_document_file_link']);
-                preg_match('/name="([^"]+)"/', $decode_url, $name_matches);
-
-                if (!empty($name_matches[1])) {
-                    $name_key = $name_matches[1];
-                    $pattern = '';
-
-                    if ($name_key === 'acf-url' && class_exists('ACF') && function_exists('get_field')) {
-                        $pattern = '/"key":"[^"]+:(.*?)"/';
-                    } elseif ($name_key === 'toolset-url' && class_exists('Types_Helper_Output_Meta_Box')) {
-                        $pattern = '/"key":"[^"]+:(.*?)"/';
-                    } elseif ($name_key === 'jet-post-custom-field' && class_exists('Jet_Engine')) {
-                        $pattern = '/"meta_field":"([^"]+)"/';
-                    }
-
-                    if ($pattern) {
-                        preg_match($pattern, $decode_url, $matches);
-
-                        if (!empty($matches[1])) {
-                            $get_field_key = sanitize_key($matches[1]);
-
-                            $url = '';
-
-                            if ($name_key === 'acf-url') {
-                                $url = get_field($get_field_key);
-                            } elseif ($name_key === 'toolset-url') {
-                                $url = get_post_meta(get_the_ID(), 'wpcf-' . $get_field_key, true);
-                             } elseif ($name_key === 'jet-post-custom-field') {
-                                 $url = get_post_meta(get_the_ID(), $get_field_key, true);
-                            }
-
-                            $url = apply_filters('embedpress/custom_meta_field_value', $url, $get_field_key);
-
-                            // Fallback
-                            if (empty($url)) {
-                                preg_match('/"fallback":"([^"]+)"/', $decode_url, $fallback_matches);
-                                if (!empty($fallback_matches[1])) {
-                                    $url = $fallback_matches[1];
-                                }
-                            }
-
-                            // Final sanitization before output
-                            $url = esc_url_raw($url);
-                        }
-                    }
-                }
+        if ($settings['embedpress_document_type'] === 'url' && !empty($settings['__dynamic__']['embedpress_document_file_link'])) {
+            $resolved = DynamicFieldResolver::resolve_elementor_dynamic($settings['__dynamic__']['embedpress_document_file_link']);
+            if ($resolved !== '') {
+                $url = $resolved;
             }
         }
         $hash_pass = hash('sha256', wp_salt(32) . md5($settings['embedpress_doc_lock_content_password']));
--- a/embedpress/EmbedPress/Elementor/Widgets/Embedpress_Pdf.php
+++ b/embedpress/EmbedPress/Elementor/Widgets/Embedpress_Pdf.php
@@ -10,6 +10,7 @@
 use ElementorControls_Manager as Controls_Manager;
 use ElementorModulesDynamicTagsModule as TagsModule;
 use ElementorWidget_Base as Widget_Base;
+use EmbedPressIncludesClassesDynamicFieldResolver;
 use EmbedPressIncludesClassesHelper;
 use EmbedPressIncludesTraitsBranding;

@@ -1093,54 +1094,10 @@
         $is_editor_view = Plugin::$instance->editor->is_edit_mode();
         $url = $this->get_file_url();

-        if ($settings['embedpress_pdf_type'] === 'url') {
-            if (!empty($settings['__dynamic__']['embedpress_pdf_file_link'])) {
-                $decode_url = urldecode($settings['__dynamic__']['embedpress_pdf_file_link']);
-                preg_match('/name="([^"]+)"/', $decode_url, $name_matches);
-
-                if (!empty($name_matches[1])) {
-                    $name_key = $name_matches[1];
-                    $pattern = '';
-
-                    if ($name_key === 'acf-url' && class_exists('ACF') && function_exists('get_field')) {
-                        $pattern = '/"key":"[^"]+:(.*?)"/';
-                    } elseif ($name_key === 'toolset-url' && class_exists('Types_Helper_Output_Meta_Box')) {
-                        $pattern = '/"key":"[^"]+:(.*?)"/';
-                    } elseif ($name_key === 'jet-post-custom-field' && class_exists('Jet_Engine')) {
-                        $pattern = '/"meta_field":"([^"]+)"/';
-                    }
-
-                    if ($pattern) {
-                        preg_match($pattern, $decode_url, $matches);
-
-                        if (!empty($matches[1])) {
-                            $get_field_key = sanitize_key($matches[1]);
-
-                            $url = '';
-
-                            if ($name_key === 'acf-url') {
-                                $url = get_field($get_field_key);
-                            } elseif ($name_key === 'toolset-url') {
-                                $url = get_post_meta(get_the_ID(), 'wpcf-' . $get_field_key, true);
-                             } elseif ($name_key === 'jet-post-custom-field') {
-                                 $url = get_post_meta(get_the_ID(), $get_field_key, true);
-                            }
-
-                            $url = apply_filters('embedpress/custom_meta_field_value', $url, $get_field_key);
-
-                            // Fallback if empty
-                            if (empty($url)) {
-                                preg_match('/"fallback":"([^"]+)"/', $decode_url, $fallback_matches);
-                                if (!empty($fallback_matches[1])) {
-                                    $url = $fallback_matches[1];
-                                }
-                            }
-
-                            // Final sanitization
-                            $url = esc_url_raw($url);
-                        }
-                    }
-                }
+        if ($settings['embedpress_pdf_type'] === 'url' && !empty($settings['__dynamic__']['embedpress_pdf_file_link'])) {
+            $resolved = DynamicFieldResolver::resolve_elementor_dynamic($settings['__dynamic__']['embedpress_pdf_file_link']);
+            if ($resolved !== '') {
+                $url = $resolved;
             }
         }

--- a/embedpress/EmbedPress/Ends/Back/Settings/EmbedpressSettings.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/EmbedpressSettings.php
@@ -219,7 +219,7 @@
 	}

 	public function register_menu() {
-		add_menu_page( __('EmbedPress Settings', 'embedpress'), 'EmbedPress', 'manage_options', $this->page_slug,
+		add_menu_page( __('EmbedPress Settings', 'embedpress'), __('EmbedPress', 'embedpress'), 'manage_options', $this->page_slug,
 			[ $this, 'render_settings_page' ], EMBEDPRESS_URL_ASSETS.'images/menu-icon.svg', 64 );

 		// Add Dashboard submenu (replaces the default first submenu item)
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/ads.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/ads.php
@@ -81,7 +81,7 @@
                </svg>

            </span>
-           <span>Video</span>
+           <span><?php esc_html_e('Video', 'embedpress'); ?></span>
          </div>
        <div class="btn-img sponsored-toggle_btn ">
            <span>
@@ -99,7 +99,7 @@
                    </defs>
                  </svg>
            </span>
-           <span>Images</span>
+           <span><?php esc_html_e('Images', 'embedpress'); ?></span>
        </div>
     </div>

--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/calendly.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/calendly.php
@@ -312,11 +312,11 @@
                 <table class="rwd-table" cellspacing="0">
                     <tbody>
                         <tr>
-                            <th>Date & Time</th>
-                            <th>Event Type</th>
-                            <th>Attendee</th>
-                            <th>Scheduled</th>
-                            <th>Status</th>
+                            <th><?php esc_html_e('Date & Time', 'embedpress'); ?></th>
+                            <th><?php esc_html_e('Event Type', 'embedpress'); ?></th>
+                            <th><?php esc_html_e('Attendee', 'embedpress'); ?></th>
+                            <th><?php esc_html_e('Scheduled', 'embedpress'); ?></th>
+                            <th><?php esc_html_e('Status', 'embedpress'); ?></th>
                         </tr>
                         <?php
                         $index = 0;
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/custom-logo.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/custom-logo.php
@@ -42,7 +42,7 @@
 	        do_action( 'embedpress_before_custom_branding_settings_fields');
 	        echo  $nonce_field ; ?>
             <div class="form__group">
-                <p class="form__label">Powered by EmbedPress</p>
+                <p class="form__label"><?php esc_html_e('Powered by EmbedPress', 'embedpress'); ?></p>
                 <div class="form__control__wrap">
                     <label class="input__switch switch__text">
                         <input type="checkbox" data-default="<?php echo esc_attr(  $embedpress_document_powered_by ); ?>" data-value="<?php echo esc_attr(  $embedpress_document_powered_by ); ?>" value="yes" name="embedpress_document_powered_by" <?php checked( 'yes', $embedpress_document_powered_by );?>>
@@ -155,7 +155,7 @@
         <p class="form__label"><?php
             $provider_name = $provider === 'youtube' ? 'YouTube' : ucfirst( $provider);
 			printf( esc_html__( '%s Custom Branding', 'embedpress'), $provider_name);
-			echo $pro_active ? '': ' <span class="isPro">Pro</span>';
+			echo $pro_active ? '' : ' <span class="isPro">' . esc_html__('Pro', 'embedpress') . '</span>';

 			// // Show indicator if using global brand
 			// if ($should_use_global) {
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/google-calendar.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/google-calendar.php
@@ -106,7 +106,7 @@
 	            <?php if ( !$pro_active ) {  include EMBEDPRESS_SETTINGS_PATH . 'templates/partials/alert-pro.php'; } ?>

             </div>
-                <h2>Calendars</h2>
+                <h2><?php esc_html_e('Calendars', 'embedpress'); ?></h2>
                 <div class="form__group">
                     <label for="epgc_cache_time" class="form__label" ><?php esc_html_e( "Select calendars to show", "embedpress" ); echo $pro_active ? '': ' <span class="isPro">PRO</span>';  ?> </label>
                     <div class="form__control__wrap <?php echo $pro_active ? '': 'isPro'; ?>">
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/hub.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/hub.php
@@ -62,7 +62,13 @@
                                     <h2 class="embedpress-font-xl embedpress-font-family-dmsans embedpress-banner-header"><?php esc_html_e('Free Plan', 'embedpress'); ?></h2>
                                 </div>
                                 <p class="embedpress-font-m embedpress-font-family-dmsans embedpress-banner-sub-header">
-                                    You’re using the free version with access to 250+ sources, basic updates, and forum support. <a href="<?php echo esc_url('https://wpdeveloper.com/in/upgrade-embedpress'); ?>" target="_blank" class="embdpress-hilight-text">View upgrades</a>.
+                                    <?php
+                                    printf(
+                                        /* translators: %s: "View upgrades" link */
+                                        esc_html__('You’re using the free version with access to 250+ sources, basic updates, and forum support. %s.', 'embedpress'),
+                                        '<a href="' . esc_url('https://wpdeveloper.com/in/upgrade-embedpress') . '" target="_blank" class="embdpress-hilight-text">' . esc_html__('View upgrades', 'embedpress') . '</a>'
+                                    );
+                                    ?>
                                 </p>
                             </div>
                             <div class="embedpress-right-content">
@@ -83,12 +89,18 @@
                                     <h2 class="embedpress-font-xl embedpress-font-family-dmsans embedpress-banner-header"><?php esc_html_e('Brand Your Work', 'embedpress'); ?></h2>
                                 </div>
                                 <p class="embedpress-font-m embedpress-font-family-dmsans embedpress-banner-sub-header">
-                                    Stand out with every embed. Add your logo and drive traffic back to your site. <a href="<?php echo esc_url('https://wpdeveloper.com/in/upgrade-embedpress'); ?>" target="_blank" class="embdpress-hilight-text"> Upgrade now to unlock branding! </a>
+                                    <?php
+                                    printf(
+                                        /* translators: %s: link to upgrade page */
+                                        esc_html__('Stand out with every embed. Add your logo and drive traffic back to your site. %s', 'embedpress'),
+                                        '<a href="' . esc_url('https://wpdeveloper.com/in/upgrade-embedpress') . '" target="_blank" class="embdpress-hilight-text"> ' . esc_html__('Upgrade now to unlock branding!', 'embedpress') . ' </a>'
+                                    );
+                                    ?>
                                 </p>
                             </div>
                             <div class="embedpress-right-content">
                                 <div class="embedpress-preview-area embedpress-height-95">
-                                    <div class=" embedpress-font-m embedpress-tag">Premium</div>
+                                    <div class=" embedpress-font-m embedpress-tag"><?php esc_html_e('Premium', 'embedpress'); ?></div>
                                     <img src="<?php echo esc_url(EMBEDPRESS_URL_ASSETS . 'images/img-in.png'); ?>" alt="<?php esc_attr_e('Premium Feature Preview', 'embedpress'); ?>">
                                 </div>
                             </div>
@@ -112,9 +124,12 @@
                                     <?php echo $license_status === 'expired' ? __('License Expired', 'embedpress') : __('License Required', 'embedpress'); ?>
                                 </h2>
                             </span>
-                            <h3 class="embedpress-font-l embdpress-hilight-text embedpress-font-family-dmsans embedpress-banner-secondary-header"><?php echo esc_html($username); ?>, you’ve installed EmbedPress Pro!</h3>
+                            <h3 class="embedpress-font-l embdpress-hilight-text embedpress-font-family-dmsans embedpress-banner-secondary-header"><?php
+                                /* translators: %s: WordPress username */
+                                printf(esc_html__('%s, you’ve installed EmbedPress Pro!', 'embedpress'), esc_html($username));
+                            ?></h3>
                             <p class="embedpress-font-m embedpress-font-family-dmsans embedpress-mb-16 embedpress-font-m embedpress-banner-sub-header">
-                                Activate your license key to enable EmbedPress Pro’s features and to start receiving automatic updates and premium support. </p>
+                                <?php esc_html_e('Activate your license key to enable EmbedPress Pro’s features and to start receiving automatic updates and premium support.', 'embedpress'); ?> </p>
                             <a href="<?php echo esc_url(admin_url('admin.php?page=embedpress&page_type=license')); ?>" class="embedpress-btn embedpress-license-btn   embedpress-activate-license-btn ">
                                 <span class="embedpress-line-height-0 ">
                                     <img src="<?php echo esc_url(EMBEDPRESS_URL_ASSETS . 'images/icons/key-removebg-preview 1.png'); ?>" alt="<?php esc_attr_e('License Key Icon', 'embedpress'); ?>">
@@ -331,19 +346,19 @@
                             </a>
                         </div>
                     <?php endif; ?>
-                    <span class="premium-tag">Premium</span>
-                    <h2 class="embedpress-font-xl embedpress-font-family-dmsans embedpress-pop-up-header">Unlock More Power in Every Embed</h2>
+                    <span class="premium-tag"><?php esc_html_e('Premium', 'embedpress'); ?></span>
+                    <h2 class="embedpress-font-xl embedpress-font-family-dmsans embedpress-pop-up-header"><?php esc_html_e('Unlock More Power in Every Embed', 'embedpress'); ?></h2>
                     <p class="embedpress-font-m embedpress-font-family-dmsans embedpress-pop-up-sub-header">
-                        Take full control of your embeds, Customize every detail, protect your<br> content, and unlock monetization features to grow your business.</span>
+                        <?php echo wp_kses(__('Take full control of your embeds, Customize every detail, protect your<br> content, and unlock monetization features to grow your business.', 'embedpress'), ['br' => []]); ?>
                     </p>
                     <ul class="embedpress-premium-features-list">
-                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item">Add your own logo</li>
-                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item">Lock content for members</li>
-                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item">Apply lazy loading</li>
-                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item">Control PDF usage</li>
-                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item">Control video playback</li>
-                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item">Show custom ads in embeds</li>
-                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item">Advanced analytics</li>
+                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item"><?php esc_html_e('Add your own logo', 'embedpress'); ?></li>
+                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item"><?php esc_html_e('Lock content for members', 'embedpress'); ?></li>
+                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item"><?php esc_html_e('Apply lazy loading', 'embedpress'); ?></li>
+                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item"><?php esc_html_e('Control PDF usage', 'embedpress'); ?></li>
+                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item"><?php esc_html_e('Control video playback', 'embedpress'); ?></li>
+                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item"><?php esc_html_e('Show custom ads in embeds', 'embedpress'); ?></li>
+                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-premium-features-list-item"><?php esc_html_e('Advanced analytics', 'embedpress'); ?></li>
                     </ul>
                     <a target="_blank" href="<?php echo esc_url('https://embedpress.com/in/unlock-premium-features'); ?>" class="embedpress-btn embedpress-btn-primary embedpress-pop-up-btn">
                         <span class="embedpress-line-height-0 embedpress-mr-4 pop-up-btn-icon">
@@ -366,7 +381,7 @@
                         <img src="<?php echo esc_url(EMBEDPRESS_URL_ASSETS . 'images/right-content-img.png'); ?>" alt="<?php esc_attr_e('Premium Features Image', 'embedpress'); ?>">
                     </div>
                     <div class="embedress-text-wrapper">
-                        <p class="embedpress-font-m embedpress-font-family-dmsans">Premium users get full branding, control, and monetization</p>
+                        <p class="embedpress-font-m embedpress-font-family-dmsans"><?php esc_html_e('Premium users get full branding, control, and monetization', 'embedpress'); ?></p>
                     </div>
                 </div>
             </div>
@@ -394,7 +409,7 @@
         $popular_sources = [
             // PDFs & Docs
             'docs' => [
-                'title' => 'PDFs & Docs',
+                'title' => __('PDFs & Docs', 'embedpress'),
                 'icon' => EMBEDPRESS_URL_ASSETS . 'images/icons/docs-icon 1.png',
                 'sources' => [
                     ['name' => 'PDF', 'provider' => 'pdf', 'icon' => $icon_src . '/pdf.svg', 'settings_url' => '', 'doc_url' => 'https://wpdeveloper.com/embed-pdf-documents-wordpress', 'arival_status' => 'popular'],
@@ -405,7 +420,7 @@
             ],
             // Video Sources
             'video' => [
-                'title' => 'Audio & Video',
+                'title' => __('Audio & Video', 'embedpress'),
                 'icon' => EMBEDPRESS_URL_ASSETS . 'images/sources/audio-video.svg',
                 'sources' => [
                     ['name' => 'YouTube', 'provider' => 'youtube', 'icon' => $icon_src . '/youtube.svg', 'settings_url' => esc_url(admin_url('admin.php?page=embedpress&page_type=youtube')), 'doc_url' => 'https://embedpress.com/docs/embed-youtube-wordpress/', 'arival_status' => 'popular'],
@@ -417,7 +432,7 @@
             ],
             // Social Media
             'social' => [
-                'title' => 'Social Media',
+                'title' => __('Social Media', 'embedpress'),
                 'icon' => EMBEDPRESS_URL_ASSETS . 'images/sources/social.svg',
                 'sources' => [
                     ['name' => 'Facebook', 'provider' => 'facebook', 'icon' => $icon_src . '/facebook.svg', 'settings_url' => '', 'doc_url' => 'https://embedpress.com/docs/embed-facebook-posts-wordpress/', 'arival_status' => 'popular'],
@@ -428,7 +443,7 @@
             ],
             // Audio & Music
             'audio' => [
-                'title' => 'Others',
+                'title' => __('Others', 'embedpress'),
                 'icon' => EMBEDPRESS_URL_ASSETS . 'images//sources/automations.svg',
                 'sources' => [
                     ['name' => 'Google Photos', 'provider' => 'google-photos', 'icon' => $icon_src . '/google-photos.svg', 'settings_url' => '', 'doc_url' => 'https://embedpress.com/docs/embed-google-photos-in-wordpress/', 'arival_status' => 'popular'],
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/instagram.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/instagram.php
@@ -128,7 +128,7 @@
                                     <!-- <td>1312</td> -->
                                     <td style="text-transform: uppercase;"><?php echo esc_attr($data['account_type']); ?></td>

-                                    <td><button class="user-profile-link" title="<?php echo esc_attr('https://instagram.com/' . $data['username']) ?>">Copy</button></td>
+                                    <td><button class="user-profile-link" title="<?php echo esc_attr('https://instagram.com/' . $data['username']) ?>"><?php esc_html_e('Copy', 'embedpress'); ?></button></td>

                                     <td class="instagram-sync-data" data-userid="<?php echo esc_attr($data['user_id']) ?>" data-acceess-token="<?php echo esc_attr($data['access_token']) ?>" data-account-type="<?php echo esc_attr($data['account_type']) ?>">
                                         <i class="dashicons dashicons-update-alt emcs-dashicon"></i>
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/main-template.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/main-template.php
@@ -75,7 +75,7 @@
                                     <ol class="embedpress-follow-steps-list">
                                         <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Type "/" in the Gutenberg editor to find the respective EmbedPress block.', 'embedpress'); ?></li>
                                         <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Paste your link or upload your file in the block.', 'embedpress'); ?></li>
-                                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Hit publish on the page - that's it! ', 'embedpress'); ?><a href="https://embedpress.com/blog/embed-any-type-of-content-in-gutenberg/" target="_blank">See Documentation</a></li>
+                                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Hit publish on the page - that's it! ', 'embedpress'); ?><a href="https://embedpress.com/blog/embed-any-type-of-content-in-gutenberg/" target="_blank"><?php esc_html_e('See Documentation', 'embedpress'); ?></a></li>
                                     </ol>
                                 </div>

@@ -85,7 +85,7 @@
                                     <ol class="embedpress-follow-steps-list">
                                         <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Search and drag-n-drop EmbedPress widget into the page/post.', 'embedpress'); ?></li>
                                         <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Paste your link or upload your file in the left bar field.', 'embedpress'); ?></li>
-                                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Hit publish on the page - that's it! ', 'embedpress'); ?><a href="https://embedpress.com/docs/embedpress-with-elementor/" target="_blank">See Documentation</a></li>
+                                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Hit publish on the page - that's it! ', 'embedpress'); ?><a href="https://embedpress.com/docs/embedpress-with-elementor/" target="_blank"><?php esc_html_e('See Documentation', 'embedpress'); ?></a></li>
                                     </ol>
                                 </div>

@@ -95,7 +95,7 @@
                                     <ol class="embedpress-follow-steps-list">
                                         <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Go to "Shortcode" tab from the EmbedPress dashboard.', 'embedpress'); ?></li>
                                         <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Paste your link and generate the shortcode.', 'embedpress'); ?></li>
-                                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Use the shortcode on Classic Editor, Divi, Beaver Builder, etc. page builders to display content - that's it! ', 'embedpress'); ?><a href="https://embedpress.com/docs/how-to-use-embedpress-shortcodes-for-page-builders" target="_blank">See Documentation</a></li>
+                                        <li class="embedpress-font-m embedpress-font-family-dmsans embedpress-follow-steps-list-item"><?php esc_html_e('Use the shortcode on Classic Editor, Divi, Beaver Builder, etc. page builders to display content - that's it! ', 'embedpress'); ?><a href="https://embedpress.com/docs/how-to-use-embedpress-shortcodes-for-page-builders" target="_blank"><?php esc_html_e('See Documentation', 'embedpress'); ?></a></li>
                                     </ol>
                                 </div>
                             </div>
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/partials/feature-notice.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/partials/feature-notice.php
@@ -45,7 +45,7 @@
                         </svg>
                         Analytics dashboard</strong> to track every embed performance: see total counts, views, clicks, geo insights, etc.
                 </span>
-                <a href="<?php echo esc_url($learn_more_url); ?>" target="_blank" class="embedpress-feature-notice-link">Learn More</a>
+                <a href="<?php echo esc_url($learn_more_url); ?>" target="_blank" class="embedpress-feature-notice-link"><?php esc_html_e('Learn More', 'embedpress'); ?></a>
             </div>
         </div>
         <!-- <button class="embedpress-feature-notice-close" type="button" aria-label="<?php esc_attr_e('Dismiss notice', 'embedpress'); ?>">
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/partials/sidebar.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/partials/sidebar.php
@@ -90,7 +90,7 @@
                         <svg width="20" height="22" viewBox="0 0 20 22" fill="none" xmlns="http://www.w3.org/2000/svg">
                             <path d="M19 15.008V6.99a1.98 1.98 0 0 0-1-1.717l-7-4.008a2.02 2.02 0 0 0-2 0L2 5.273c-.619.355-1 1.01-1 1.718v8.018c0 .709.381 1.363 1 1.717l7 4.008a2.02 2.02 0 0 0 2 0l7-4.008c.619-.355 1-1.01 1-1.718M10 21V11m0 0 8.73-5.04m-17.46 0L10 11" stroke="#988FBD" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" />
                         </svg>
-                    </span> Branding</a>
+                    </span> <?php esc_html_e('Branding', 'embedpress'); ?></a>
             </li>
             <?php do_action('ep_before_branding_menu'); ?>

--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/settings.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/settings.php
@@ -21,7 +21,7 @@
 ?>

 <div class="embedpress__settings  background__white radius-16 p-24">
-	<h3>Global Embed iFrame</h3>
+	<h3><?php esc_html_e('Global Embed iFrame', 'embedpress'); ?></h3>
 	<div class="shortcode-settings-wrapper">
 		<div class="embedpress__settings embedpress_general_settings__form">
 			<div class="embedpress__settings__form">
@@ -157,7 +157,11 @@
 				<div class="gradient-color">
 					<img class="embedpress-banner" src="<?php echo esc_url('https://embedpress.com/wp-content/uploads/2023/10/Mega-Page.gif'); ?>"
 						alt="">
-					<h3 class="cart-title">Upgrade To <span>Pro</span></h3>
+					<h3 class="cart-title"><?php printf(
+						/* translators: %s: highlighted "Pro" label */
+						esc_html__('Upgrade To %s', 'embedpress'),
+						'<span>' . esc_html__('Pro', 'embedpress') . '</span>'
+					); ?></h3>
 					<ul class="feature-list">
 						<li><img src="<?php echo esc_url(EMBEDPRESS_URL_ASSETS . 'images/check2.svg'); ?>" alt=""><?php echo esc_html__('Social Share', 'embedpress'); ?></li>
 						<li><img src="<?php echo esc_url(EMBEDPRESS_URL_ASSETS . 'images/check2.svg'); ?>" alt=""><?php echo esc_html__('Lazy Loading', 'embedpress'); ?></li>
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/shortcode.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/shortcode.php
@@ -19,7 +19,7 @@
 				<div class="form__group">
 					<input type="text" class="form__control" id="ep-shortcode" readonly>
 				</div>
-				<button class="button button__themeColor copy__button" id="ep-shortcode-cp"><i class="ep-icon ep-copy"></i><span>Copy Link</span></button>
+				<button class="button button__themeColor copy__button" id="ep-shortcode-cp"><i class="ep-icon ep-copy"></i><span><?php esc_html_e('Copy Link', 'embedpress'); ?></span></button>
 			</div>
 		</div>
 		<?php if (empty($pro_active) || !$pro_active) : ?>
--- a/embedpress/EmbedPress/Ends/Back/Settings/templates/wistia.php
+++ b/embedpress/EmbedPress/Ends/Back/Settings/templates/wistia.php
@@ -207,7 +207,7 @@
 				</div>
 			</div>
 			<div class="form__group">
-				<p class="form__label">Plugin: Focus</p>
+				<p class="form__label"><?php esc_html_e('Plugin: Focus', 'embedpress'); ?></p>
 				<div class="form__control__wrap">
 					<div data-default="<?php echo esc_attr(  $plugin_focus ); ?>" data-value="<?php echo esc_attr(  $plugin_focus ); ?>" class="input__flex input__radio_wrap">
 						<label class="input__radio">
--- a/embedpress/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php
+++ b/embedpress/EmbedPress/Gutenberg/EmbedPressBlockRenderer.php
@@ -2,6 +2,7 @@

 namespace EmbedPressGutenberg;

+use EmbedPressIncludesClassesDynamicFieldResolver;
 use EmbedPressIncludesClassesHelper;
 use EmbedPressShortcode;
 use Exception;
@@ -49,6 +50,38 @@
     ];

     /**
+     * Apply per-post dynamic-source resolution to the block's URL attribute.
+     *
+     * When a block declares `dynamicSource` + `dynamicField`, the saved URL
+     * (and saved iframe `$content`) reflects the editor preview only. Resolve
+     * the URL from the current post's custom field and signal the caller to
+     * discard any cached `$content` so the iframe re-renders.
+     *
+     * @param array  $attributes Block attributes, modified in place.
+     * @param string $url_key    Attribute key holding the URL ('url' or 'href').
+     * @return bool True when the URL was replaced and any cached content
+     *              should be discarded.
+     */
+    private static function apply_dynamic_source(array &$attributes, $url_key = 'url')
+    {
+        if (empty($attributes['dynamicSource']) || empty($attributes['dynamicField'])) {
+            return false;
+        }
+
+        $resolved = DynamicFieldResolver::resolve_field(
+            $attributes['dynamicSource'],
+            $attributes['dynamicField']
+        );
+
+        if ($resolved === '') {
+            return false;
+        }
+
+        $attributes[$url_key] = $resolved;
+        return true;
+    }
+
+    /**
      * Check if URL belongs to a dynamic provider
      *
      * @param string $url The URL to check
@@ -73,6 +106,7 @@
      */
     public static function render_dynamic_content($attributes)
     {
+        self::apply_dynamic_source($attributes, 'url');
         $url = $attributes['url'] ?? '';

         if (!class_exists('\EmbedPress\Shortcode')) {
@@ -129,6 +163,15 @@
      */
     public static function render($attributes, $content = '', $block = null)
     {
+        // Resolve dynamic-source URL (per-post custom field) before any
+        // saved-content shortcut. If the URL came from a field, the saved
+        // $content / embedHTML were built for the editor-preview URL and must
+        // be discarded so render_embed_html() can re-resolve the embed.
+        if (self::apply_dynamic_source($attributes, 'url')) {
+            $content = '';
+            unset($attributes['embedHTML']);
+        }
+
         // Extract basic attributes
         $url = $attributes['url'] ?? '';
         $client_id = !empty($attributes['clientId']) ? md5($attributes['clientId']) : '';
@@ -410,6 +453,11 @@

     public static function render_embedpress_pdf($attributes, $content = '', $block = null)
     {
+        // Per-post dynamic source — discard saved iframe HTML so the viewer
+        // is rebuilt against the resolved href.
+        if (self::apply_dynamic_source($attributes, 'href')) {
+            $content = '';
+        }

         // Extract basic attributes for PDF block
         $href = $attributes['href'] ?? '';
@@ -443,6 +491,9 @@

     public static function render_document($attributes, $content = '', $block = null)
     {
+        if (self::apply_dynamic_source($attributes, 'href')) {
+            $content = '';
+        }

         // Extract basic attributes for PDF block
         $href = $attributes['href'] ?? '';
--- a/embedpress/EmbedPress/Includes/Classes/DynamicFieldResolver.php
+++ b/embedpress/EmbedPress/Includes/Classes/DynamicFieldResolver.php
@@ -0,0 +1,151 @@
+<?php
+
+namespace EmbedPressIncludesClasses;
+
+if (!defined('ABSPATH')) {
+    exit;
+}
+
+/**
+ * Resolves dynamic embed URLs from custom-field sources (ACF, MetaBox, Pods,
+ * Toolset, JetEngine, raw post meta).
+ *
+ * Used by:
+ *   - Elementor PDF / Document widgets via resolve_elementor_dynamic()
+ *   - Gutenberg block renderer + shortcode via resolve_field()
+ *
+ * Why one class: the three surfaces (Elementor / Gutenberg / shortcode) all
+ * need the same source map. Keeping it in one place means adding a new field
+ * plugin (e.g. SCF, Carbon Fields) touches one method, not three.
+ */
+class DynamicFieldResolver
+{
+    /**
+     * Resolve a custom-field URL given an explicit source + field name.
+     * Used by Gutenberg blocks and shortcodes (which know their source directly).
+     *
+     * @param string   $source  acf|metabox|pods|toolset|jetengine|meta
+     * @param string   $field   Field name / key on the current post.
+     * @param int|null $post_id Defaults to current queried post.
+     * @return string Resolved URL, or '' when no value / source unavailable.
+     */
+    public static function resolve_field($source, $field, $post_id = null)
+    {
+        $field = sanitize_key((string) $field);
+        if ($field === '') {
+            return '';
+        }
+
+        if ($post_id === null) {
+            $post_id = get_the_ID();
+        }
+        if (!$post_id) {
+            return '';
+        }
+
+        $url = '';
+
+        switch ($source) {
+            case 'acf':
+                if (function_exists('get_field')) {
+                    $value = get_field($field, $post_id);
+                    $url   = is_array($value) && isset($value['url']) ? $value['url'] : (string) $value;
+                }
+                break;
+
+            case 'metabox':
+                // MetaBox exposes rwmb_meta(); fall back to raw post meta if unavailable.
+                if (function_exists('rwmb_meta')) {
+                    $value = rwmb_meta($field, '', $post_id);
+                    $url   = is_array($value) && isset($value['url']) ? $value['url'] : (string) $value;
+                } else {
+                    $url = (string) get_post_meta($post_id, $field, true);
+                }
+                break;
+
+            case 'pods':
+                if (function_exists('pods_field')) {
+                    $value = pods_field(get_post_type($post_id), $post_id, $field, true);
+                    $url   = is_array($value) && isset($value['guid'])
+                        ? $value['guid']
+                        : (is_array($value) && isset($value['url']) ? $value['url'] : (string) $value);
+                } else {
+                    $url = (string) get_post_meta($post_id, $field, true);
+                }
+                break;
+
+            case 'toolset':
+                // Toolset Types prefixes meta keys with `wpcf-`.
+                $url = (string) get_post_meta($post_id, 'wpcf-' . $field, true);
+                break;
+
+            case 'jetengine':
+            case 'meta':
+            default:
+                $url = (string) get_post_meta($post_id, $field, true);
+                break;
+        }
+
+        // Back-compat: existing free 4.5.x filter, applied by the legacy
+        // Elementor PDF/Document inline resolvers. Keep firing it from the
+        // central path so third-party code keeps working.
+        $url = apply_filters('embedpress/custom_meta_field_value', $url, $field);
+
+        return is_string($url) ? trim($url) : '';
+    }
+
+    /**
+     * Resolve a dynamic URL coming from Elementor's `__dynamic__` payload
+     * (the picker emits an HTML-encoded blob containing the source + field).
+     *
+     * @param string $dynamic_value Raw `__dynamic__[<control>]` value.
+     * @return string Resolved URL, or '' if nothing could be resolved.
+     */
+    public static function resolve_elementor_dynamic($dynamic_value)
+    {
+        if (empty($dynamic_value)) {
+            return '';
+        }
+
+        $decoded = urldecode($dynamic_value);
+
+        if (!preg_match('/name="([^"]+)"/', $decoded, $name_matches)) {
+            return '';
+        }
+        $name_key = $name_matches[1];
+
+        $source  = '';
+        $pattern = '';
+
+        if ($name_key === 'acf-url' && class_exists('ACF') && function_exists('get_field')) {
+            $source  = 'acf';
+            $pattern = '/"key":"[^"]+:(.*?)"/';
+        } elseif ($name_key === 'toolset-url' && class_exists('Types_Helper_Output_Meta_Box')) {
+            $source  = 'toolset';
+            $pattern = '/"key":"[^"]+:(.*?)"/';
+        } elseif ($name_key === 'jet-post-custom-field' && class_exists('Jet_Engine')) {
+            $source  = 'jetengine';
+            $pattern = '/"meta_field":"([^"]+)"/';
+        }
+
+        if ($source === '' || !preg_match($pattern, $decoded, $matches) || empty($matches[1])) {
+            return self::elementor_fallback($decoded);
+        }
+
+        $url = self::resolve_field($source, $matches[1]);
+
+        if ($url === '') {
+            $url = self::elementor_fallback($decoded);
+        }
+
+        return esc_url_raw($url);
+    }
+
+    private static function elementor_fallback($decoded)
+    {
+        if (preg_match('/"fallback":"([^"]+)"/', $decoded, $m)) {
+            return (string) $m[1];
+        }
+        return '';
+    }
+}
--- a/embedpress/EmbedPress/Includes/Traits/Shared.php
+++ b/embedpress/EmbedPress/Includes/Traits/Shared.php
@@ -143,113 +143,26 @@
             ]
         );

-        // $b_message            = '<p style="margin-top: 0; margin-bottom: 10px;">Black Friday Sale: Save up to 40% now & <strong>embed from 250+</strong> sources with advanced features ⚡</p><a class="button button-primary" href="https://wpdeveloper.com/upgrade/embedpress-bfcm" target="_blank">Upgrade to PRO</a> <button data-dismiss="true" class="dismiss-btn button button-link">I don’t want to save money</button>';
-        // $_black_friday_notice = [
-        //     'thumbnail' => $_assets_url . 'images/full-logo.svg',
-        //     'html'      => $b_message,
-        // ];
-
-        // $notices->add(
-        //     'black_friday_notice',
-        //     $_black_friday_notice,
-        //     [
-        //         'start'       => $notices->time(),
-        //         'recurrence'  => false,
-        //         'dismissible' => true,
-        //         'refresh'     => EMBEDPRESS_VERSION,
-        //         "expire"      => strtotime('11:59:59pm 2nd December, 2023'),
-        //         'display_if'  => !is_plugin_active('embedpress-pro/embedpress-pro.php')
-        //     ]
-        // );
-
-        // $b_message            = '<p style="margin-top: 0; margin-bottom: 10px;"><strong>Akah  Join Us in Celebrating 100K+ Users!</strong> Enjoy up to 30% OFF for EmbedPress PRO & embed from 250+ sources</p><a class="button button-primary" href="https://wpdeveloper.com/upgrade/embedpress-bfcm" target="_blank">Upgrade to PRO</a> <button data-dismiss="true" class="dismiss-btn button button-link">I don’t want to save money</button>';
-        // $_black_friday_notice = [
-        //     'thumbnail' => $_assets_url . 'images/full-logo.svg',
-        //     'html'      => $b_message,
-        // ];
-
-        // $notices->add(
-        //     '100k_notice',
-        //     $_black_friday_notice,
-        //     [
-        //         'start'       => $notices->time(),
-        //         'recurrence'  => false,
-        //         'dismissible' => true,
-        //         'refresh'     => EMBEDPRESS_VERSION,
-        //         "expire"      => strtotime('11:59:59pm 12th September, 2024'),
-        //         'display_if'  => !is_plugin_active('embedpress-pro/embedpress-pro.php')
-        //     ]
-        // );
-
-        // $b_message            = '<div class="helloween_2024_notice"><p style="margin-top: 0; margin-bottom: 0px;">🎃 Unlock advanced embedding functionalities with EmbedPress PRO & enjoy <strong>Up to $150 Off</strong> this Halloween.</p><a class="button button-primary" href="https://embedpress.com/halloween-2024/" target="_blank">
-        // <svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="m15.743 10.938.161-1.578c.086-.842.142-1.399.098-1.749h.015c.727 0 1.316-.622 1.316-1.389s-.589-1.389-1.315-1.389c-.727 0-1.316.622-1.316 1.39 0 .346.12.663.32.907-.287.186-.66.58-1.223 1.171-.434.456-.65.684-.893.72a.7.7 0 0 1-.394-.059c-.223-.104-.372-.385-.67-.95l-1.57-2.97a22 22 0 0 0-.476-.873c.569-.306.958-.93.958-1.65C10.754 1.496 9.97.667 9 .667s-1.754.829-1.754 1.852c0 .72.389 1.344.958 1.65-.139.234-.293.525-.476.873l-1.57 2.97c-.298.565-.447.846-.67.95a.7.7 0 0 1-.394.058c-.242-.035-.46-.263-.893-.719-.563-.592-.937-.985-1.223-1.171.2-.244.32-.56.32-.908 0-.767-.589-1.389-1.316-1.389-.726 0-1.315.622-1.315 1.39 0 .766.589 1.388 1.315 1.388h.016c-.045.35.012.906.098 1.749l.16 1.578c.09.876.164 1.71.255 2.46H15.49c.09-.75.165-1.584.254-2.46m-7.698 6.395h1.908c2.488 0 3.732 0 4.562-.784.362-.342.591-.959.757-1.762H2.727c.166.803.395 1.42.757 1.762.83.784 2.074.784 4.562.784" fill="#fff"/></svg> Upgrade to PRO</a></div>';
-        // $_helloween_2024_notice = [
-        //     'thumbnail' => $_assets_url . 'images/full-logo.svg',
-        //     'html'      => $b_message,
-        // ];
-
-
-        // $notices->add(
-        //     'helloween_2024_notice',
-        //     $_helloween_2024_notice,
-        //     [
-        //         'start'       => $notices->time(),
-        //         'recurrence'  => false,
-        //         'dismissible' => true,
-        //         'refresh'     => EMBEDPRESS_VERSION,
-        //         "expire"      => strtotime('11:59:59pm 3rd November, 2024'),
-        //         'display_if' => !is_plugin_active('embedpress-pro/embedpress-pro.php') && ($_SERVER['REQUEST_URI'] === '/wp-admin/' || $_SERVER['REQUEST_URI'] === '/wp-admin/index.php'),
-        //     ]
-        // );
-
-        // $king_icon = '<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="m15.743 10.938.161-1.578c.086-.842.142-1.399.098-1.749h.015c.727 0 1.316-.622 1.316-1.389s-.589-1.389-1.315-1.389c-.727 0-1.316.622-1.316 1.39 0 .346.12.663.32.907-.287.186-.66.58-1.223 1.171-.434.456-.65.684-.893.72a.7.7 0 0 1-.394-.059c-.223-.104-.372-.385-.67-.95l-1.57-2.97a22 22 0 0 0-.476-.873c.569-.306.958-.93.958-1.65C10.754 1.496 9.97.667 9 .667s-1.754.829-1.754 1.852c0 .72.389 1.344.958 1.65-.139.234-.293.525-.476.873l-1.57 2.97c-.298.565-.447.846-.67.95a.7.7 0 0 1-.394.058c-.242-.035-.46-.263-.893-.719-.563-.592-.937-.985-1.223-1.171.2-.244.32-.56.32-.908 0-.767-.589-1.389-1.316-1.389-.726 0-1.315.622-1.315 1.39 0 .766.589 1.388 1.315 1.388h.016c-.045.35.012.906.098 1.749l.16 1.578c.09.876.164 1.71.255 2.46H15.49c.09-.75.165-1.584.254-2.46m-7.698 6.395h1.908c2.488 0 3.732 0 4.562-.784.362-.342.591-.959.757-1.762H2.727c.166.803.395 1.42.757 1.762.83.784 2.074.784 4.562.784" fill="#fff"/></svg>';
-
-
-        // $holiday_message = '<div class="bfriday_2025_notice"><p class="notice-message"><strong>Black Friday Mega Sale:</strong> Custom branding, ads, content protection, analytics and more – now <strong>up to $160 OFF!</strong> 🎁 </p>
-        // <div class="notice-links">
-        //     <a class="button button-primary" href="https://embedpress.com/bfcm2025-admin-notice" target="_blank">Upgrade to PRO</a>
-        //     <a class="embedpress-notice-dismiss-button dismiss-btn" data-dismiss="true" href="#" target="_blank">I’ll Grab it Later</a>
-
-        // </div>
-        // </div>';
-        // $_bfriday_2025_notice = [
-        //     'thumbnail' => $_assets_url . 'images/full-logo.svg',
-        //     'html'      => $holiday_message,
-        // ];
-
-        // $notices->add(
-        //     'bfriday_2025_notice',
-        //     $_bfriday_2025_notice,
-        //     [
-        //         'start'       => $notices->time(),
-        //         'recurrence'  => false,
-        //         'dismissible' => true,
-        //         'refresh'     => EMBEDPRESS_VERSION,
-        //         "expire"      => strtotime('11:59:59pm 4th December, 2026'),
-        //         'display_if' => !is_plugin_active('embedpress-pro/embedpress-pro.php') && ($_SERVER['REQUEST_URI'] === '/wp-admin/' || $_SERVER['REQUEST_URI'] === '/wp-admin/index.php'),
-        //     ]
-        // );
-
-        $spring_message = '<div class="spring_2026_notice"><p class="notice-message"><span class="notice-emoji">🌸</span> <strong>Spring Savings:</strong> Custom Branding, Ads, Content Protection, Analytics And More With 250+ Embed Sources – Now <strong>Flat 25% OFF!</strong> ⚡️</p>
+        $summer_message = '<div class="summer_2026_notice"><p class="notice-message"><span class="notice-emoji">🏖️</span> <strong>Summer Savings:</strong> Custom branding, ads, content protection, analytics and more with 250+ embed sources – now <strong>up to $150 OFF!</strong></p>
         <div class="notice-links">
-            <a class="button button-primary" href="https://embedpress.com/spring2026-admin-notice" target="_blank">Upgrade To Pro Now</a>
-            <a class="embedpress-notice-dismiss-button dismiss-btn" data-dismiss="true" href="#" target="_blank">Maybe Later</a>
+            <a class="button button-primary" href="https://embedpress.com/summer2026-admin-notice" target="_blank">Upgrade To Pro Now</a>
+            <a class="embedpress-notice-dismiss-button dismiss-btn" data-dismiss="true" href="#" target="_blank">I Don’t Want Any Discount</a>
         </div>
         </div>';
-        $_spring_2026_notice = [
+        $_summer_2026_notice = [
             'thumbnail' => $_assets_url . 'images/full-logo.svg',
-            'html'      => $spring_message,
+            'html'      => $summer_message,
         ];

         $notices->add(
-            '_spring_2026_notice',
-            $_spring_2026_notice,
+            '_summer_2026_notice',
+            $_summer_2026_notice,
             [
-                'start'       => strtotime('8th April 2026'),
+                'start'       => strtotime('20th May 2026'),
                 'recurrence'  => false,
                 'dismissible' => true,
                 'refresh'     => EMBEDPRESS_VERSION,
-                "expire"      => strtotime('11:59:59pm 10th May 2026'),
+                "expire"      => strtotime('11:59:59pm 25th June 2026'),
                 'display_if' => !is_plugin_active('embedpress-pro/embedpress-pro.php') && ($_SERVER['REQUEST_URI'] === '/wp-admin/' || $_SERVER['REQUEST_URI'] === '/wp-admin/index.php'),
             ]
         );
--- a/embedpress/EmbedPress/Providers/TemplateLayouts/YoutubeLayout.php
+++ b/embedpress/EmbedPress/Providers/TemplateLayouts/YoutubeLayout.php
@@ -34,7 +34,7 @@
                 <a target="_blank" href="<?php echo esc_url('https://www.youtube.com/' . $handle);  ?>" class="subscribe-button">
                     <svg width="16" height="20" viewBox="0 0 16 20" fill="none" xmlns="http://www.w3.org/2000/svg">
                         <path fill-rule="evenodd" clip-rule="evenodd" d="M9.467 1.653A1.6 1.6 0 0 1 8.4 3.093 6.026 6.026 0 0 1 14 9.067v4.586c0 1.067.053 1.92.96 2.4a.694.694 0 0 1-.267 1.28H8.88a1.333 1.333 0 1 1-1.76 0H1.36a.693.693 0 0 1-.32-1.28c.907-.48.96-1.333.96-2.4V9.067a6.027 6.027 0 0 1 5.6-5.974 1.493 1.493 0 1 1 1.867-1.44m-1.44 2.774a4.8 4.8 0 0 0-4.694 4.64v4.693c0 .587 0 1.493-.373 2.293h10.133c-.426-.8-.373-1.653-.373-2.293V9.067a4.8 4.8 0 0 0-1.405-3.289c-.874-.874-2.052-1.324-3.288-1.351" fill="#fff" /></svg>
-                    <?php echo esc_html__('Subscribe', 'embbedpress'); ?></a>
+                    <?php echo esc_html__('Subscribe', 'embedpress'); ?></a>
             </div>
         </div>
         <?php
@@ -57,6 +57,13 @@
         $videoUrl = $videoId ? "https://www.youtube.com/watch?v={$videoId}" : null;


+        $title        = esc_html($title);
+        $description  = esc_html($description);
+        $viewCount    = esc_html($viewCount);
+        $likeCount    = esc_html($likeCount);
+        $commentCount = esc_html($commentCount);
+        $publishedAt  = esc_html($publishedAt);
+
         $html = "
         <div class='youtube-video-description'>
             <div class='youtube-video-header'>
--- a/embedpress/EmbedPress/Providers/Youtube.php
+++ b/embedpress/EmbedPress/Providers/Youtube.php
@@ -578,8 +578,11 @@

             $main_iframe = '';
             if (!empty($gallery->first_vid) && empty($params['ytChannelLayout']) || $params['ytChannelLayout'] === 'gallery') {
-                $rel = "https://www.youtube.com/embed/{$gallery->first_vid}?feature=oembed";
-                $main_iframe = "<div class='ep-first-video'><iframe width='{$params['maxwidth']}' height='{$params['maxheight']}' src='$rel' frameborder='0' allow='accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture' allowfullscreen title='{$title}'></iframe></div>";
+                $rel = esc_url("https://www.youtube.com/embed/{$gallery->first_vid}?feature=oembed");
+                $iframe_width  = esc_attr($params['maxwidth']);
+                $iframe_height = esc_attr($params['maxheight']);
+                $iframe_title  = esc_attr($title);
+                $main_iframe = "<div class='ep-first-video'><iframe width='{$i

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
SecRule REQUEST_URI "@streq /wp-json/wp/v2/posts" "id:20267996,phase:1,deny,status:403,chain,msg:'Atomic Edge WAF Rule - CVE-2026-7796',severity:'CRITICAL',tag:'CVE-2026-7796'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule ARGS_POST:content "@rx <script[^>]*>[^<]*</script>" "t:none,t:lowercase,chain"
      SecRule ARGS_POST:content "@rx embedpress" "t:none,t:lowercase"

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School