What is the CVSS score of CVE-2026-6809?

CVE-2026-6809 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Social Post Embed CVE-2026-6809

EUVD-2026-25987 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-28 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 05:30 euvd

EUVD-2026-25987

Analysis Generated

Apr 28, 2026 - 05:30 vuln.today

CVE Published

Apr 28, 2026 - 04:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on the user-supplied URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Social Post Embed plugin for WordPress up to version 2.0.1 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into page content via the Threads embed handler due to insufficient input sanitization and output escaping. Injected scripts execute when any user views the affected page, enabling session hijacking, credential theft, or malware distribution from trusted WordPress sites. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the Threads embed handler (threads.php) of the Social Post Embed plugin, which processes user-supplied URLs for embedding social media posts. The underlying issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a foundational weakness in web application security. The plugin fails to properly sanitize URL inputs before storing them in the database and does not escape output when rendering embedded content, allowing malicious JavaScript to be injected directly into WordPress post/page HTML. This affects the core embed functionality where user input is expected to contain legitimate Threads URLs but is instead processed without validation or encoding, making it a classic stored XSS vector. The CPE cpe:2.3:a:dartiss:social_post_embed:*:*:*:*:*:*:*:* confirms all versions through 2.0.1 are affected.

RemediationAI

Update Social Post Embed to version 2.0.2 or later immediately. The vendor has released a patched version that corrects the input sanitization and output escaping issues in the Threads embed handler (references show fixes applied in threads.php at lines 49, 50, and 61 in version 2.0.2). WordPress administrators can update via the WordPress admin dashboard (Plugins → Updates) or via command line with wp plugin update social-post-embed. For sites unable to update immediately, restrict Contributor-level access to only trusted users by reviewing WordPress user roles (Settings → Users) and demoting or removing suspicious accounts. Disable the Threads embed feature if it is not actively used by visiting the plugin settings and removing any enabled Threads embed functionality. Monitor for suspicious posts/pages created by contributor accounts between the last security audit and patching, and audit all post revisions for injected scripts.