dartiss code-embed vulnerabilities

Latest dartiss code-embed CVEs

Newest publication first

1. CVE-2026-48093 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed

   Published 2026-08-07

   Medium·CVSS 6.5 EPSS 0.29%

   The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote respon...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.