CVE-2026-2512 is a stored cross-site scripting vulnerability in the Code Embed plugin for WordPress by dartiss. The plugin's sanitization function sec_check_post_fields() is only invoked during the save_post hook, but WordPress allows custom fields to be added through the wp_ajax_add_meta AJAX endpoint without triggering this hook. Consequently, the ce_filter() function outputs unsanitized meta values directly into page content without escaping, enabling authenticated users with Contributor-level permissions or higher to inject arbitrary scripts that execute on page load.

An attacker with Contributor-level or higher access can inject malicious JavaScript into WordPress pages via custom fields, leading to stored XSS. This can result in the execution of arbitrary scripts in the context of users viewing the affected pages, potentially compromising user sessions or performing unauthorized actions. The impact is limited to confidentiality and integrity with no direct availability impact, as reflected in the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting the use of the Code Embed plugin. Monitor for updates from the vendor and apply patches promptly once released.