EUVD-2026-12833Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This is due to the plugin's sanitization function sec_check_post_fields() only running on the save_post hook, while WordPress allows custom fields to be added via the wp_ajax_add_meta AJAX endpoint without triggering save_post. The ce_filter() function then outputs these unsanitized meta values directly into page content without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Code Embed plugin for WordPress (versions up to 2.5.1) contains a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into pages through custom field meta values. The vulnerability exists because the plugin's sanitization function only runs during post saves, while WordPress AJAX endpoints can add meta fields without triggering sanitization, and the plugin then outputs these unsanitized values directly without HTML escaping. An attacker can inject malicious scripts that execute whenever any user visits an affected page, potentially leading to session hijacking, credential theft, or malware distribution.
Technical ContextAI
The vulnerability is a classic stored XSS (CWE-79) in the Code Embed plugin (identified by CPE cpe:2.3:a:dartiss:code_embed:*:*:*:*:*:*:*:*) that stems from improper input validation and output encoding in WordPress plugin architecture. The root cause involves two design flaws: first, the sec_check_post_fields() sanitization function only executes on the save_post hook, which does not fire when custom meta fields are added via the wp_ajax_add_meta AJAX endpoint that WordPress provides natively. Second, the ce_filter() function retrieves these meta values and outputs them directly into page content without using WordPress escaping functions like esc_html() or wp_kses_post(). This creates a gap where attacker-controlled data persists in the database and is rendered without protection.
RemediationAI
Immediately upgrade the Code Embed plugin to version 2.5.2 or later, which should include fixes to the sec_check_post_fields() sanitization function to cover the wp_ajax_add_meta endpoint and ensure ce_filter() properly escapes output. Check the WordPress plugin repository changelog at plugins.trac.wordpress.org/changeset/3482994 for confirmation of the patch. Until patching is possible, restrict Contributor-level access to only trusted authors, disable custom field UI for standard users by removing the custom_fields post type support, and consider using a Web Application Firewall (WAF) rule to block unusual script patterns in POST requests to wp-admin/admin-ajax.php. Additionally, audit existing post meta values for suspicious JavaScript patterns using WordPress database queries and remove any injected content from the database.
More in Code Embed
View allA vulnerability in David Artiss Code Embed simple-embed-code.3.6. Rated medium severity (CVSS 6.5), this vulnerability i
Stored XSS in the Code Embed WordPress plugin (versions prior to 2.6.1) permits a Contributor-role attacker to plant a U
The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functiona
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today