PT-2026-26068 · Dartiss · Code Embed

Muhammad Yudha · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-2512

NVD

CVSS v3.1

6.4

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This is due to the plugin's sanitization function sec check post fields() only running on the save post hook, while WordPress allows custom fields to be added via the wp ajax add meta AJAX endpoint without triggering save post. The ce filter() function then outputs these unsanitized meta values directly into page content without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2512

Affected Products

Code Embed

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2512 · Security Note
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/add-embeds.php#L20 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/375ed04b-a3cb-4e60-83c8-18bff583aaf4?source=cve · Note
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/secure.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/add-embeds.php#L84 · Note
• https://plugins.trac.wordpress.org/changeset/3482994 · Note