What is the CVSS score of CVE-2026-2512?

CVE-2026-2512 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2512?

Organizations using Code Embed should be aware of moderate risk from CVE-2026-2512, a cross-site scripting vulnerability rated CVSS 6.4.. A patch is available.

How to fix or mitigate CVE-2026-2512?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting v and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-2512

EUVD-2026-12833 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 15:45 euvd

EUVD-2026-12833

Analysis Generated

Mar 18, 2026 - 15:45 vuln.today

CVE Published

Mar 18, 2026 - 15:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This is due to the plugin's sanitization function sec_check_post_fields() only running on the save_post hook, while WordPress allows custom fields to be added via the wp_ajax_add_meta AJAX endpoint without triggering save_post. The ce_filter() function then outputs these unsanitized meta values directly into page content without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Code Embed plugin for WordPress (versions up to 2.5.1) contains a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into pages through custom field meta values. The vulnerability exists because the plugin's sanitization function only runs during post saves, while WordPress AJAX endpoints can add meta fields without triggering sanitization, and the plugin then outputs these unsanitized values directly without HTML escaping. An attacker can inject malicious scripts that execute whenever any user visits an affected page, potentially leading to session hijacking, credential theft, or malware distribution.

Technical ContextAI

The vulnerability is a classic stored XSS (CWE-79) in the Code Embed plugin (identified by CPE cpe:2.3:a:dartiss:code_embed:*:*:*:*:*:*:*:*) that stems from improper input validation and output encoding in WordPress plugin architecture. The root cause involves two design flaws: first, the sec_check_post_fields() sanitization function only executes on the save_post hook, which does not fire when custom meta fields are added via the wp_ajax_add_meta AJAX endpoint that WordPress provides natively. Second, the ce_filter() function retrieves these meta values and outputs them directly into page content without using WordPress escaping functions like esc_html() or wp_kses_post(). This creates a gap where attacker-controlled data persists in the database and is rendered without protection.

RemediationAI

Immediately upgrade the Code Embed plugin to version 2.5.2 or later, which should include fixes to the sec_check_post_fields() sanitization function to cover the wp_ajax_add_meta endpoint and ensure ce_filter() properly escapes output. Check the WordPress plugin repository changelog at plugins.trac.wordpress.org/changeset/3482994 for confirmation of the patch. Until patching is possible, restrict Contributor-level access to only trusted authors, disable custom field UI for standard users by removing the custom_fields post type support, and consider using a Web Application Firewall (WAF) rule to block unusual script patterns in POST requests to wp-admin/admin-ajax.php. Additionally, audit existing post meta values for suspicious JavaScript patterns using WordPress database queries and remove any injected content from the database.