Code Embed
Monthly
Stored XSS in the Code Embed WordPress plugin (versions prior to 2.6.1) permits a Contributor-role attacker to plant a URL embed token referencing an attacker-controlled server; when an Administrator or Editor previews or reviews the pending post, the plugin fetches the remote URL and injects the unfiltered response body-including arbitrary JavaScript-directly into the rendered page. The root cause is a dual omission in add-embeds.php: no output sanitization on fetched remote content and no unfiltered_html capability check before URL-embed expansion, a pattern confirmed by the commit diff from the fix release. No public exploit has been identified at time of analysis; vendor-released patch 2.6.1 is confirmed by a GitHub release tag, a commit, and the plugin changelog.
The Code Embed plugin for WordPress (versions up to 2.5.1) contains a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into pages through custom field meta values. The vulnerability exists because the plugin's sanitization function only runs during post saves, while WordPress AJAX endpoints can add meta fields without triggering sanitization, and the plugin then outputs these unsanitized values directly without HTML escaping. An attacker can inject malicious scripts that execute whenever any user visits an affected page, potentially leading to session hijacking, credential theft, or malware distribution.
The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions up to, and including, 2.4 due to insufficient restrictions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability in David Artiss Code Embed simple-embed-code.3.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored XSS in the Code Embed WordPress plugin (versions prior to 2.6.1) permits a Contributor-role attacker to plant a URL embed token referencing an attacker-controlled server; when an Administrator or Editor previews or reviews the pending post, the plugin fetches the remote URL and injects the unfiltered response body-including arbitrary JavaScript-directly into the rendered page. The root cause is a dual omission in add-embeds.php: no output sanitization on fetched remote content and no unfiltered_html capability check before URL-embed expansion, a pattern confirmed by the commit diff from the fix release. No public exploit has been identified at time of analysis; vendor-released patch 2.6.1 is confirmed by a GitHub release tag, a commit, and the plugin changelog.
The Code Embed plugin for WordPress (versions up to 2.5.1) contains a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into pages through custom field meta values. The vulnerability exists because the plugin's sanitization function only runs during post saves, while WordPress AJAX endpoints can add meta fields without triggering sanitization, and the plugin then outputs these unsanitized values directly without HTML escaping. An attacker can inject malicious scripts that execute whenever any user visits an affected page, potentially leading to session hijacking, credential theft, or malware distribution.
The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions up to, and including, 2.4 due to insufficient restrictions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability in David Artiss Code Embed simple-embed-code.3.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.