LiveActive security incident?Get immediate response
CVE Record

CVE-2026-2512: Code Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields

The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1. This is due to the plugin's sanitization function `sec_check_post_fields()` only running on the `save_post` hook, while WordPress allows custom fields to be added via the `wp_ajax_add_meta` AJAX endpoint without triggering `save_post`. The `ce_filter()` function then outputs these unsanitized meta values directly into page content without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

MediumCVSS 6.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-2512 affects the WordPress Code Embed plugin through version 2.5.1. A logged-in user with Contributor-level access or higher can store script content in custom fields. That script can run for visitors to the affected page, creating risk of account compromise, content manipulation, or visitor targeting.

Executive priority

Treat as a medium-priority website integrity issue. Prioritize internet-facing WordPress sites with multiple content contributors. The main business concern is stored malicious content affecting visitors or administrators, not direct server takeover based on the provided evidence.

Technical view

The flaw is stored cross-site scripting, CWE-79, CVSS 6.4. Sanitization runs on the save_post hook, but WordPress custom fields can be added through wp_ajax_add_meta without triggering that path. Code Embed’s ce_filter() then outputs unsanitized meta values into page content without escaping.

Likely exposure

Exposure is limited to WordPress sites using Code Embed version 2.5.1 or earlier and allowing Contributor-level or higher accounts. Sites with many authors, weak account governance, or compromised contributor accounts face higher practical risk.

Exploitation context

The attacker must authenticate with Contributor-level privileges or above. Public sources do not indicate active exploitation, and this CVE is not listed as KEV in the provided data. Successful abuse results in stored script execution when users access an injected page.

Researcher notes

Key condition is the sanitization gap between save_post and wp_ajax_add_meta, followed by unescaped output in ce_filter(). Validate defensively by reviewing affected versions, code paths, and stored metadata. Avoid assuming unauthenticated impact; the sources specify Contributor-level access and above.

Mitigation direction

  • Update Code Embed to a version newer than 2.5.1 if available from the vendor.
  • If no fixed release is available, follow vendor guidance and consider disabling the plugin.
  • Restrict Contributor and higher accounts to trusted users only.
  • Review and remove unnecessary WordPress author accounts.
  • Monitor affected posts for suspicious custom field content.

Validation and detection

  • Inventory WordPress sites running the Code Embed plugin.
  • Confirm installed plugin versions and flag 2.5.1 or earlier.
  • Review Contributor, Author, Editor, and Administrator account legitimacy.
  • Inspect post custom fields for unexpected script-like content.
  • Check vendor changelog or WordPress Trac changeset for remediation status.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-2512 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.4CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N3.12.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.4Medium
CVSS 3.1 vector shape for CVE-2026-2512Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
dartissCode Embed0unaffected
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs