Reflected Cross-Site Scripting Vulnerability in EmbedAI by EmbedAI Inc.

CVE-2025-0746

What is CVE-2025-0746?

A reflected cross-site scripting vulnerability has been identified in EmbedAI versions prior to 2.1. Authenticated attackers can exploit this flaw by constructing carefully crafted URLs that leverage the '/embedai/users/show/' endpoint. When a victim accesses this malicious URL, the embedded JavaScript code is executed in their browser, potentially leading to unauthorized actions, data theft, or other adverse impacts on users' security.

References