CyberRota Analysis
AI-GeneratedThe Code Embed WordPress plugin versions prior to 2.6.1 are susceptible to stored Cross-Site Scripting (XSS) due to inadequate sanitization of content fetched from external URLs. This vulnerability allows a Contributor-level attacker to inject malicious JavaScript into posts, which executes when an Administrator or Editor previews the content. WordPress site administrators and users of the affected plugin should prioritize updating to version 2.6.1 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.