EmbedPress

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

659 searches this plugin appeared in over the last 90 days, 20 listed. 615 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 2.2 years ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ EnvisionDesign

   4mo ago

   I had a couple issues with background color and mobile sizing (video when viewed on mobile) and went to Embed Press’s website and chatted with their support and he solved it in short order. Works great.

   Read on wp.org ↗
2. ★★★★★ Robert Remiger

   4mo ago

   Florence was very helpful and guided me through the ‘how-to’ on all the questions I had. Great to get quick and accurate support.

   Read on wp.org ↗
3. ★★★★★ mfinet

   4mo ago

   Hello,Florence provided excellent and timely service with a variety of questions I had regarding EmbedPress. I’m new to the tool and she diligently dug in and was very patient with my questions. I wish more customer service reps were more like Florence. My only suggestion for your support team in general is it would be nice if support could acknowledge that they received the question. When using the support system the last few days, I had to ask if anyone was there after my initial question. Thank you, and great job, Florence!

   Read on wp.org ↗
4. ★★★★★ melinagorini

   4mo ago

   Great customer service

   Read on wp.org ↗
5. ★★★★★ jameselkins

   4mo ago

   EmbedPress works perfectly and is easy to use. I’m writing this because of the customer support. I use the free version, so I didn’t expect much: but when I asked a question, I got quick, polite answers, and when they accelerated my question to the development team, they continued to follow up. They fixed the issue, and got back to me with the results. Absaolutely amazing for the free tier!

   Read on wp.org ↗
6. ★★★★★ mmzeiger

   4mo ago

   I needed a straightforward way to show PDFs on our WordPress site without fighting raw iframes, browser quirks, or inconsistent viewer layouts. EmbedPress was exactly what I was looking for. Installation took minutes — search, install, activate, done. No complicated setup or extra configuration just to get started. Displaying PDFs is genuinely easy. Paste the document URL, generate the shortcode, drop it into the page, and it works. Compared to hand-coding iframes and hoping every browser behaves the same, this felt like a huge relief. The viewer looks clean and professional, and our members see the documents the way we intended. If you want PDFs on WordPress without a steep learning curve, EmbedPress is a no-brainer. Highly recommend it for anyone who wants simple setup and reliable results.<gwmw style=”display:none;”></gwmw>

   Read on wp.org ↗
7. ★★★★★ buhejji

   5mo ago

   I have had a very positive experience using EmbedPress, and I consider it one of the best PDF presentation and embedding tools available. The application is easy to use, integrates smoothly with websites, and offers professional display features that significantly enhance the user experience. I would also like to commend the support team for their outstanding customer service. Their responsiveness, professionalism, and genuine care in following up on issues clearly reflect their strong commitment to supporting customers and providing effective solutions. Overall, EmbedPress is an excellent and highly reliable tool that I would gladly recommend to anyone looking for an elegant, efficient, and professional way to display PDF content.

   Read on wp.org ↗
8. ★★★★★ novgorod

   5mo ago

   After Google Photos removed the API in 2025, this plugin is, to my knowledge, the only one still supporting it via web scraping (if Google doesn’t care about the unnecessary extra traffic, why should we, right?). The scraping works well enough and is reasonably fast, but the gallery implementation is extremely barebones and lacks 95% of features that are standard for any modern media gallery (pages, layout customization, metadata etc.). In addition, videos within a Google Photos album are completely ignored – I had to manually add video parsing functionality to the GooglePhotos.php (Embedpress/Providers) and my php knowledge is that of a caveman, so it’s beyond me why that’s not implemented. Sure, it costs Google even more unnecessary traffic (oh no)… And since some recent update within the last few months, the standard Gutenberg editor integration was broken, at least for Google Photos (not sure if it’s due to a plugin update or WordPress 7.0 update). Creating an Embedpress block with the album URL works normally, it shows a preview and lets you edit the block parameters. Saving also works and the gallery shows up on the page/post. However, if you go back into the editor, the Embedpress block data can’t be accessed and you’re shown the empty block mask asking you for the URL (see screenshot: i.imgur.com/8Lc1GO0.png) – so you have to re-setup the Embedpress block every time you edit the page/post. A current workaround is to use shortcodes with the album URL and the undocumented “mode” parameter for the Google Photos gallery (e.g. mode=’gallery-justify’). If only there was some kind of forum or Github page to discuss these issues publicly instead of using the review section, but alas… This topic was modified 1 month, 1 week ago by novgorod.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-28 Version 4.7.1 Fixed: Elementor PDF and Document widgets showed no file when the URL came from a dynamic source (such as an ACF field) without EmbedPress Pro. Few minor bug fixes and improvements. 4.7.1
2. 2026-10-19 Version 4.7.0 Improved: Pro features now live entirely in EmbedPress Pro, so the free plugin no longer ships locked Pro code. Pro features require EmbedPress Pro 3.10.0 or newer. Improved: Analytics charts now use Chart.js, bundled wi 4.7.0
3. 2026-10-07 Version 4.6.8 Fixed: Unauthenticated requests could spend the site’s YouTube API quota and create cache entries through the YouTube gallery pagination endpoints (security fix). Props to Alberto Ucendo Martínez (WPScan) for the respons 4.6.8
4. 2026-09-24 Version 4.6.7 Fixed: Stored XSS vulnerability via the carousel slides-to-show attribute (security fix). Fixed: PHP warning “Undefined array key html” when rendering embeds in the block editor. Few minor bug fixes and improvements. 4.6.7
5. 2026-09-15 Version 4.6.6 Fixed: YouTube embeds showing “Error 153” instead of the video preview in the block editor. Fixed: Reflected XSS vulnerability in the social share meta tag when embedding PDFs (security fix). Fixed: SmugMug direct image 4.6.6
6. 2026-09-01 Version 4.6.5 Fixed: Author and byline links from other plugins appearing oversized on pages with no embed. Fixed: Analytics preventing Cloudflare and other CDNs from caching any page on the site. Few minor bug fixes and improvements. 4.6.5

All 40 disclosed vulnerabilities are patched in the current version (4.7.1). Sites still on an older version should update.

1. Patched Medium · 6.4 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute ↗
   2026-10-02 CVE-2026-92727 Improper Neutralization of Input During Web Page Generation Affects <= 4.6.6 Patched in 4.6.7
2. Patched Medium · 6.4 EmbedPress 4.4.9 - 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-09-28 CVE-2026-85001 Improper Neutralization of Input During Web Page Generation Affects 4.4.9 - 4.6.6 Patched in 4.6.7
3. Patched Medium · 6.4 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-09-25 CVE-2026-85002 Improper Neutralization of Input During Web Page Generation Affects <= 4.6.6 Patched in 4.6.7
4. Patched Medium · 6.1 EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters ↗
   2026-09-17 CVE-2026-89330 Improper Neutralization of Input During Web Page Generation Affects <= 4.6.5 Patched in 4.6.6
5. Patched Medium · 4.3 EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Missing Authorization ↗
   2026-09-05 CVE-2026-84926 Missing Authorization Affects 4.6.0 - 4.6.3 Patched in 4.6.4
6. Patched Medium · 5.3 EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Unauthenticated Paid API Consumption and Database Row Injection ↗
   2026-09-03 CVE-2026-84936 Uncontrolled Resource Consumption Affects 4.6.0 - 4.6.3 Patched in 4.6.4
7. Patched Medium · 4.3 EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents 4.6.0 - 4.6.3 - Missing Authorization to Authenticated (Contributor+) Site-Wide Places Library Modification ↗
   2026-09-03 CVE-2026-84927 Missing Authorization Affects 4.6.0 - 4.6.3 Patched in 4.6.4
8. Patched High · 7.2 EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-08-03 CVE-2026-61961 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.6 Patched in 4.6.0
9. Patched High · 7.2 EmbedPress <= 4.6.0 - Unauthenticated Blind Server-Side Request Forgery ↗
   2026-07-27 CVE-2026-10526 Server-Side Request Forgery Affects <= 4.6.0 Patched in 4.6.1
10. Patched Medium · 6.4 EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute ↗
    2026-06-05 CVE-2026-7796 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.3 Patched in 4.5.4
11. Patched Medium · 5.3 EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more <= 4.5.2 - Unauthenticated Information Exposure ↗
    2026-06-01 CVE-2026-48872 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.5.2 Patched in 4.5.3
12. Patched Medium · 6.4 EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name' ↗
    2024-11-27 CVE-2024-11203 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.3 Patched in 4.1.4
13. Patched Medium · 6.4 EmbedPress <= 4.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-10-24 CVE-2024-50461 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.14 Patched in 4.1.0
14. Patched Medium · 6.4 EmbedPress <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-08-26 CVE-2024-43936 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.8 Patched in 4.0.9
15. Patched Critical · 9.8 EmbedPress <= 4.0.9 - Unauthenticated Local File Inclusion ↗
    2024-08-16 CVE-2024-43328 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 4.0.9 Patched in 4.0.10
16. Patched Medium · 5.3 EmbedPress <= 4.0.4 - Missing Authorization ↗
    2024-07-11 CVE-2024-38707 Missing Authorization Affects <= 4.0.4 Patched in 4.0.5
17. Patched Medium · 6.4 EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL ↗
    2024-06-12 CVE-2024-1565 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.10 Patched in 3.9.11
18. Patched Medium · 6.4 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget ↗
    2024-06-04 CVE-2024-5571 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.1 Patched in 4.0.2
19. Patched Medium · 4.3 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual ↗
    2024-05-22 CVE-2024-1803 Improper Authorization Affects <= 3.9.12 Patched in 3.9.13
20. Patched Medium · 6.4 PDF.js < 4.2.67 - Arbitrary JavaScript Execution ↗
    2024-05-20 CVE-2024-4367 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.2 Patched in 4.0.3
21. Patched Medium · 6.4 EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ↗
    2024-05-09 CVE-2024-4316 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.16 Patched in 3.9.17
22. Patched Medium · 5.3 EmbedPress <= 3.9.11 - Missing Authorization ↗
    2024-04-05 CVE-2024-31274 Missing Authorization Affects <= 3.9.11 Patched in 3.9.12
23. Patched Medium · 6.4 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-04-05 CVE-2024-3244 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.14 Patched in 3.9.15
24. Patched Medium · 6.4 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block ↗
    2024-04-05 CVE-2024-3245 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.14 Patched in 3.9.15
25. Patched Medium · 5.3 EmbedPress <= 3.9.8 - Missing Authorization via handle_calendly_data ↗
    2024-04-05 CVE-2024-31284 Missing Authorization Affects <= 3.9.8 Patched in 3.9.9
26. Patched Medium · 5.4 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color' ↗
    2024-03-22 CVE-2024-2688 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.12 Patched in 3.9.13
27. Patched Medium · 6.4 EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute ↗
    2024-03-22 CVE-2024-2468 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.12 Patched in 3.9.13
28. Patched Medium · 6.4 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block ↗
    2024-03-07 CVE-2024-1802 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.10 Patched in 3.9.11
29. Patched Medium · 6.4 EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget ↗
    2024-03-07 CVE-2024-2128 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.10 Patched in 3.9.11
30. Patched Medium · 6.4 EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link ↗
    2024-02-14 CVE-2024-1425 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.8 Patched in 3.9.9
31. Patched Medium · 6.4 EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-02-14 CVE-2024-1349 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.8 Patched in 3.9.9
32. Patched Medium · 6.4 EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-01-02 CVE-2023-6986 Improper Neutralization of Input During Web Page Generation Affects < 3.9.5 Patched in 3.9.6
33. Patched Medium · 5.3 EmbedPress <= 3.9.4 - Missing Authorization ↗
    2023-12-08 Missing Authorization Affects < 3.9.5 Patched in 3.9.5
34. Patched Medium · 6.1 EmbedPress <= 3.9.1 - Reflected Cross-Site Scripting ↗
    2023-11-17 CVE-2023-5750 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.1 Patched in 3.9.2
35. Patched Medium · 6.1 EmbedPress <= 3.9.1 - Reflected Cross-Site Scripting ↗
    2023-11-17 CVE-2023-5749 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.1 Patched in 3.9.2
36. Patched Medium · 4.3 EmbedPress <= 3.8.3 - Cross-Site Request Forgery ↗
    2023-09-07 CVE-2023-51375 Cross-Site Request Forgery Affects < 3.8.4 Patched in 3.8.4
37. Patched Medium · 5.4 EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data ↗
    2023-08-09 CVE-2023-4282 Missing Authorization Affects <= 3.8.2 Patched in 3.8.3
38. Patched Medium · 6.4 EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-08-09 CVE-2023-4283 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.2 Patched in 3.8.3
39. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.2 Patched in 2.0.3
40. Patched Medium · 5.3 EmbedPress <= 3.7.3 - Sensitive Information Exposure ↗
    2023-06-26 CVE-2023-3371 Use of Hard-coded Cryptographic Key Affects <= 3.7.3 Patched in 3.8.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 17 languages, 1 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2024-08-14 90K+ → 100K+ up after 176 days in tier
2. 2024-02-20 80K+ → 90K+ up after 276 days in tier
3. 2023-05-20 70K+ → 80K+ up after 200 days in tier
4. 2022-11-01 60K+ → 70K+ up after 156 days in tier
5. 2022-05-29 50K+ → 60K+ up after 145 days in tier
6. 2022-01-04 40K+ → 50K+ up after 87 days in tier
7. 2021-10-09 30K+ → 40K+ up after 149 days in tier
8. 2021-05-13 20K+ → 30K+ up after 67 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for EmbedPress into a readme, a review or a deck. It updates itself.

EmbedPress: 100K+ active installs, 4.8★ (307 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/embedpress