Description

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-07T16:17:24.893Z",
  "pubdate": "2026-08-07T16:17:24.893Z",
  "executiveSummary": "The Code Embed WordPress plugin prior to version 2.6.1 suffers from a stored Cross-Site Scripting (XSS) vulnerability via the external URL embed feature within post content.\nThis security flaw allows an authenticated attacker with Contributor-level privileges to inject arbitrary JavaScript payloads that execute within the administrative context of a higher-privileged user.\nThe vulnerability impacts the Code Embed plugin versions up to 2.6, specifically targeting the documented external URL embedding mechanism.\nRisk implications include potential privilege escalation and full administrative compromise of the WordPress site if an Administrator or Editor previews or reviews a maliciously crafted pending post.\nExploitation requires the attacker to submit a pending post containing a specially crafted external URL token and relies on privileged user interaction to trigger the payload execution.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input sanitization and the complete absence of an unfiltered_html capability check within the external URL embed feature of the Code Embed plugin.\nWhen rendering post content, the vulnerable code scans the text for URL embed tokens, initiates a server-side request to fetch the designated remote URL, and directly embeds the raw response body into the resulting HTML page without performing any output sanitization.\nThe affected component is the external URL embed feature residing within post content processing routines, impacting all plugin versions up to 2.6, and is distinct from CVE-2026-2512 which affected custom field meta values up to version 2.5.1.\nThe attack flow proceeds as follows: First, an attacker authenticated with Contributor privileges crafts a post containing an inert-looking external URL token designed to point to an attacker-controlled external resource serving malicious JavaScript or HTML markup. Second, the attacker submits the post for review, leaving it in a pending state. Third, an Administrator or Editor accesses the WordPress dashboard to preview or review the pending post. Fourth, as the rendering engine processes the post content, the plugin fetches the remote URL and injects the attacker-controlled response body directly into the DOM without sanitization. Finally, the injected JavaScript executes within the browser context of the privileged reviewer, leading to potential session hijacking, unauthorized administrative actions, or further post-exploitation impact."
}