Social Post Embed EUVD-2026-25987

Attacker must possess WordPress Contributor-level account access (or higher, such as Editor or Administrator role). The Social Post Embed plugin must be installed and activated on the target WordPress site. The Threads embed handler functionality must be enabled within the plugin (default state unknown but implied by vulnerability presence in handler code). The attacker must have permission to create or edit WordPress posts or pages that support embed blocks. Stored XSS requires victim users to subsequently visit the page containing the injected payload-there is no requirement for victim interaction beyond page view. No special WordPress configuration or plugin settings are required for exploitation beyond plugin installation and activation. Exploitation is limited by WordPress access control; users without Contributor role or above cannot exploit this vulnerability.

While the CVSS score of 6.4 (Medium) indicates moderate severity, the real-world risk must be contextualized carefully. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) shows network-accessible, low-complexity exploitation requiring only Contributor-level privileges (not unauthenticated), and no user interaction required once payload is stored. This is a stored XSS variant, meaning the attack is persistent and impacts all site visitors without additional attacker interaction. However, the exploitation conditions significantly limit scope: an attacker must first gain Contributor-level WordPress access, which is a meaningful but surmountable barrier given WordPress site compromise rates. The Scope:Changed (S:C) indicates cross-site impact is possible. Given no public exploit code identified and no CISA KEV listing, this represents a real but not urgently weaponized vulnerability. For WordPress administrators, the practical risk depends heavily on user management-sites with restrictive contributor access and regular user audits face lower risk, while sites with numerous or loosely vetted contributors face higher exposure. The CVSS Medium rating is appropriate for the actual attack complexity and privilege requirement, though organizations hosting user-generated content should prioritize patching.

A WordPress site with multiple contributors allows a malicious insider or account-compromised contributor to navigate to a post edit screen, locate the Threads embed section, and inject a malicious URL containing JavaScript payload (e.g., a URL that references a JavaScript file or includes encoded script tags). The plugin stores this unvalidated input directly in the database. When any site visitor (including administrators and other users) views the post, the injected script executes in their browser context, stealing session cookies or WordPress authentication tokens without any user interaction required.