The Code Embed plugin for WordPress is vulnerable to stored cross‑site scripting via custom field meta values in all versions up to and including 2.5.1. The plugin’s sanitization function, `sec_check_post_fields()`, is only executed on the `save_post` hook, but WordPress permits custom fields to be added through the `wp_ajax_add_meta` AJAX endpoint without invoking `save_post`. Consequently, the `ce_filter()` function outputs these unsanitized meta values directly into page content. An attacker who is authenticated with Contributor‑level access or higher can therefore inject arbitrary JavaScript, resulting in phishing, cookie theft, defacement, or other malicious actions. This issue is identified as CWE‑79 (Improper Neutralization of Input During Web Page Generation).

All installations of the dartiss Code Embed plugin with a version number of 2.5.1 or earlier are affected. No specific patch version is listed in the data; the vulnerability exists in every build up to the mentioned release.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor‑level or higher access and does not demand external network access beyond normal WordPress traffic. Because the malicious script is stored in the database and executed whenever the affected page is rendered, any site visitor who accesses the page is at risk, making the impact potentially widespread among users of the compromised site.