WordPress Plugin Vulnerabilities

Code Embed < 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description

The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
simple-embed-code
Fixed in 2.6.1

References

CVE
CVE-2026-48093
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2e33feec-43f6-46c2-b287-752254822f4f

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (Medium)

Miscellaneous

Original Researcher
Manopakorn Kooharueangrong (manop55555)
Verified
No
WPVDB ID
1b91505f-348b-4bb5-a88f-178745f1811a

Timeline

Publicly Published
2026-05-20 (about 4 months ago)
Added
2026-09-16 (about 4 days ago)
Last Updated
2026-09-16 (about 4 days ago)

Other

Published
Title
Published
2024-11-01
Title
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate
Published
2025-07-30
Title
WP Modal Popup with Cookie Integration < 2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-10-29
Title
Black Widgets For Elementor < 1.3.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2026-03-20
Title
Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'
Published
2025-03-27
Title
AEC Kiosque < 1.9.4 - Reflected Cross-Site Scripting