The Social Post Embed WordPress plugin allows an authenticated user with Contributor or higher privileges to store a malicious URL in the Threads embed area. The plugin fails to sanitize that input and also does not escape it when rendering, so the attacker can inject arbitrary JavaScript that will run in the browser of any user who views the page containing the embed. This defacement or hijacking can lead to credential theft, session hijacking, or other client‑side attacks targeting site visitors.

WordPress sites that have the Social Post Embed plugin installed in any version up to and including 2.0.1 are affected. The vulnerability resides in the Threads embed handler in the plugin code.

With a CVSS score of 6.4 the flaw is of moderate severity. The EPSS score is not reported, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower but still non‑negligible likelihood of exploitation. An attacker only needs to be an authenticated Contributor or higher to exploit the issue, so the attack vector is local to the site’s content‑management side but the impact is on all site visitors who load the affected page.