Code Embed CVE-2026-48093

Exploitation requires a Contributor-level (or higher) WordPress account on the target site; unauthenticated or subscriber-level users cannot exploit this vulnerability. The Code Embed plugin must be installed, active, and running version 2.6.x prior to 2.6.1-the external URL embed feature introduced in version 2.6 is the specific vector, not the legacy custom-field path addressed by CVE-2026-2512 in versions up to 2.5.1. Exploitation further depends on an Administrator or Editor actively previewing or reviewing the attacker's submitted post (UI:R); without this user interaction, the stored payload cannot trigger. Sites restricting Contributor registration, running only trusted contributor accounts, or operating without an editorial review workflow for contributor content have significantly reduced realistic exposure regardless of patch status.

The provided CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (score 6.5) accurately captures the attack topology-network-reachable, low complexity, low privileges (Contributor), with mandatory administrator interaction and a scope change into the reviewing user's browser context. The Scope:Changed rating is the most consequential signal here: XSS executing in an authenticated admin session can cascade into full site compromise via admin account creation, plugin installation, or theme file modification, effects far exceeding the C:L/I:L base ratings. No EPSS data was supplied in the intelligence inputs and this CVE does not appear in CISA KEV, moderating urgency; however, stored-XSS-targeting-admin patterns in WordPress plugins are a historically active exploitation category, so the absence from KEV reflects novelty rather than low attacker interest. The binding constraint is the Contributor-role prerequisite: sites with no open registration, no untrusted Contributor accounts, or where contributor posts bypass the editorial review workflow are realistically unexploitable regardless of patch status. The fix is confirmed released.

An attacker registers or obtains a Contributor-level WordPress account on the target site, then authors a post containing a URL embed token pointing to an attacker-controlled server configured to return a JavaScript payload-such as a script that creates a rogue admin account or exfiltrates session cookies. The attacker submits the post for editorial review; when an Administrator or Editor opens the post preview or review screen, the Code Embed plugin fetches the malicious URL and injects the returned JavaScript into the rendered page, executing it in the authenticated admin browser session with full privileges. No public exploit code has been identified at time of analysis, but the attack is straightforward to reproduce from the advisory and commit diff.