CVE-2026-2512 in Code Embed Plugin
Summary
by MITRE • 03/18/2026
The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This is due to the plugin's sanitization function `sec_check_post_fields()` only running on the `save_post` hook, while WordPress allows custom fields to be added via the `wp_ajax_add_meta` AJAX endpoint without triggering `save_post`. The `ce_filter()` function then outputs these unsanitized meta values directly into page content without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/24/2026
The vulnerability identified as CVE-2026-2512 affects the Code Embed plugin for WordPress, a widely used tool for embedding code snippets and custom content within WordPress environments. This security flaw represents a critical stored cross-site scripting vulnerability that undermines the integrity of web applications relying on the plugin. The issue stems from a fundamental design flaw in how the plugin handles input sanitization and validation, creating a persistent security risk that can be exploited by authenticated attackers with relatively low privileges.
The technical root cause of this vulnerability lies in the plugin's inconsistent sanitization approach. The `sec_check_post_fields()` function, which is responsible for sanitizing custom field meta values, is only invoked during the `save_post` hook execution. However, WordPress provides an alternative pathway for adding custom fields through the `wp_ajax_add_meta` AJAX endpoint that operates independently of the standard post saving process. This architectural gap means that meta values added through the AJAX endpoint bypass the security checks implemented in `sec_check_post_fields()`, leaving them vulnerable to malicious injection.
The operational impact of this vulnerability extends beyond simple script injection, as it creates a persistent threat vector that can affect multiple users within a WordPress environment. The `ce_filter()` function subsequently outputs these unsanitized meta values directly into page content without proper HTML escaping or output encoding, creating an ideal environment for cross-site scripting attacks. This allows authenticated attackers with Contributor-level access or higher to inject malicious JavaScript code that executes whenever any user accesses a page containing the injected content, potentially leading to session hijacking, data exfiltration, or further compromise of the WordPress installation.
Attackers exploiting this vulnerability can leverage the stored XSS capability to perform various malicious activities including credential theft, defacement of content, or redirection to malicious sites. The low privilege requirement makes this vulnerability particularly dangerous as it can be exploited by users who normally have limited capabilities within the WordPress environment. According to CWE classification, this represents a stored XSS vulnerability (CWE-89) with improper neutralization of input during web output, while ATT&CK framework categorizes this under T1059.007 for command and scripting interpreter and T1566 for credential access through social engineering.
Mitigation strategies for this vulnerability should include immediate plugin updates to versions that address the sanitization inconsistency, implementing additional input validation at the WordPress level, and establishing monitoring for unauthorized meta field modifications. Organizations should also consider implementing content security policies to limit the impact of potential XSS attacks, while administrators should review user permissions and implement principle of least privilege access controls. The recommended remediation involves patching to version 2.5.2 or later, which properly addresses the AJAX endpoint sanitization gap and ensures consistent security validation across all code paths for custom field handling.