PT-2026-26068 · WordPress · Code Embed

Muhammad Yudha · Publicado 2026-03-18 · Atualizado 2026-03-18 · CVE-2026-2512

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Code Embed plugin for WordPress versions prior to 2.5.2

Description The Code Embed plugin for WordPress is susceptible to Stored Cross-Site Scripting through custom field meta values. The plugin’s sanitization function, sec check post fields(), operates only on the save post hook. However, WordPress permits the addition of custom fields via the /wp ajax add meta API endpoint without triggering this hook. Consequently, the ce filter() function outputs these unsanitized meta values directly into page content without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will then execute when a user accesses the affected page.

Recommendations Update the Code Embed plugin to version 2.5.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-2512

Produtos afetados

Code Embed

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2512 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3482994 · Nota
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/add-embeds.php#L84 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/375ed04b-a3cb-4e60-83c8-18bff583aaf4?source=cve · Nota
• https://twitter.com/CVEnew/status/2034365280256942351 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/add-embeds.php#L20 · Nota
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/secure.php#L25 · Nota