PT-2026-26068 · WordPress · Code Embed

Muhammad Yudha · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-2512

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Code Embed plugin for WordPress versions prior to 2.5.2

Description The Code Embed plugin for WordPress is susceptible to Stored Cross-Site Scripting through custom field meta values. The plugin’s sanitization function, sec check post fields(), operates only on the save post hook. However, WordPress permits the addition of custom fields via the /wp ajax add meta API endpoint without triggering this hook. Consequently, the ce filter() function outputs these unsanitized meta values directly into page content without proper escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will then execute when a user accesses the affected page.

Recommendations Update the Code Embed plugin to version 2.5.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2512

Affected Products

Code Embed

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2512 · Security Note
• https://plugins.trac.wordpress.org/changeset/3482994 · Note
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/add-embeds.php#L84 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/375ed04b-a3cb-4e60-83c8-18bff583aaf4?source=cve · Note
• https://twitter.com/CVEnew/status/2034365280256942351 · Twitter Post
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/add-embeds.php#L20 · Note
• https://plugins.trac.wordpress.org/browser/simple-embed-code/trunk/includes/secure.php#L25 · Note