CVE-2026-2512

Name of the Vulnerable Software and Affected Versions Code Embed versions prior to 2.5.2

Description Stored Cross-Site Scripting occurs via custom field meta values. The issue arises because the sanitization function sec check post fields() only executes during the save post hook, whereas the wp ajax add meta AJAX endpoint allows the addition of custom fields without triggering that hook. Subsequently, the ce filter() function outputs these unsanitized meta values directly into page content without escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update to version 2.5.2 or later.