Attack Vectors

CVE-2026-2512 is a Medium-severity Stored Cross-Site Scripting (XSS) vulnerability (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) affecting the Code Embed WordPress plugin (slug: simple-embed-code) in versions up to and including 2.5.1.

An attacker must be authenticated with at least Contributor access (or higher). Using WordPress custom fields, an attacker can store malicious script content that later renders on pages where Code Embed outputs the affected custom field values. Because this is stored XSS, it can impact any visitor (including executives, marketing staff, and administrators) who views the affected content.

Reference: CVE-2026-2512 record.

Security Weakness

The issue stems from how Code Embed handles custom field data. The plugin’s sanitization routine (sec_check_post_fields()) runs on the save_post hook, but WordPress allows custom fields to be added through the wp_ajax_add_meta endpoint without triggering save_post. As a result, certain custom field meta values can bypass the plugin’s intended checks.

When the plugin later renders content, the ce_filter() function outputs these meta values into page content without escaping, enabling stored script injection. This combination—bypassable sanitization plus unescaped output—creates a reliable path for Contributor-level users to plant persistent XSS.

Source: Wordfence vulnerability advisory.

Technical or Business Impacts

Brand and campaign risk: Malicious scripts can silently redirect visitors, alter landing-page copy, swap CTAs, or inject counterfeit forms—undermining paid media ROI and damaging trust at the exact point of conversion.

Lead and customer data exposure: Injected scripts can capture form entries or track user activity in ways that violate privacy expectations and may create compliance issues (especially if personal data is involved).

Internal account and operational risk: Because the payload is stored, it may execute in the browser of staff who review content in WordPress. This can enable session theft or unauthorized actions performed in the context of a logged-in user, expanding impact beyond a single page.

Practical remediation: Update Code Embed to version 2.5.2 (or newer patched version). Also review whether Contributor accounts are necessary for your workflow, audit recently added custom fields, and consider additional monitoring for unexpected script output on high-value marketing pages.

Similar Attacks

Stored XSS and related script-injection flaws are a recurring web risk. Examples of widely referenced XSS advisories include:

CVE-2020-11022 (jQuery)
CVE-2020-11023 (jQuery)
CVE-2021-24389