The Code Embed plugin for WordPress contains a stored XSS flaw that allows a user with Contributor permissions to embed a malicious URL token in a pending post. The plugin retrieves the content of the specified external URL and inserts it into the final page without sanitising the response or checking the authorisation token for unfiltered HTML. When an Administrator or Editor previews or reviews the post, the malicious JavaScript is executed in the context of the CMS account, giving the attacker the ability to compromise user sessions, deface content, or perform other malicious actions. The weakness is a classic input‑validation error and is catalogued as CWE‑79.

WordPress sites that have installed the dartiss:code‑embed plugin and are running any version prior to 2.6.1, including the major 2.5.x and 2.6.0 releases. The vulnerability specifically targets the remote URL embed feature used in post content. The fix is available in version 2.6.1 and later.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires that the adversary be able to submit a pending post and that an administrator or editor subsequently review it – meaning the threat comes from trusted contributors rather than external actors. Once the malicious content is rendered, the impact is local to the victim’s browser but can lead to credential theft or lateral movement. Because the flaw is stored, repeated exploitation is possible, making patching an urgent priority.