Stored Cross-Site Scripting Vulnerability in Code Embed Plugin for WordPress

CVE-2026-2512

What is CVE-2026-2512?

The Code Embed plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks. This vulnerability arises because the plugin's sanitization process for meta values does not execute in all scenarios. Specifically, the sanitization function sec_check_post_fields() activates only during the save_post hook, which allows attackers to add unsanitized custom fields through the wp_ajax_add_meta AJAX endpoint. As a result, authenticated users with Contributor-level access and above can inject malicious scripts into pages. When the content is rendered, these vulnerabilities can be exploited, leading to harmful scripts executing in the browsers of users visiting the compromised pages.

References