CVE-2026-48093 Details
Description
The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.
A stored Cross-Site Scripting (XSS) vulnerability has been identified in the Code Embed WordPress plugin, affecting versions prior to 2.6.1. The issue arises from the external URL embed feature in post content. When a post is saved, the plugin scans for URL embed tokens, retrieves the remote URL, and inserts the response body into the post without proper sanitization or a check for 'unfiltered_html' capability. This allows a Contributor to embed a seemingly harmless URL that executes malicious JavaScript when an Administrator or Editor previews the post. The vulnerability is distinct from CVE-2026-2512, which involved custom field meta values.
Users can update to Code Embed version 2.6.1, which addresses this vulnerability by adding the necessary output sanitization and capability checks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dartiss/code-embed/security/advisories/GHSA-7c9x-px5v-5hcp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/dartiss/code-embed/commit/399752029c62fea82a9bc13fd156713fb4d50ea8 | [email protected] | Source CodeVendor |
| https://github.com/dartiss/code-embed/releases/tag/2.6.1 | [email protected] | Release NotesVendor |
| https://github.com/dartiss/code-embed/security/advisories/GHSA-7c9x-px5v-5hcp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Code Embed | <= 2.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |