CVE-2026-48093 is a stored XSS vulnerability in the Code Embed WordPress plugin by dartiss, affecting versions prior to 2.6.1. The vulnerability occurs in the external URL embed feature, where the plugin scans post content for URL embed tokens, fetches the remote URL content, and inserts it into the page without sanitization or verifying the user's 'unfiltered_html' capability. This allows a contributor-level attacker to submit a post containing a crafted URL token that executes attacker-controlled JavaScript when previewed by administrators or editors. This vulnerability is distinct from CVE-2026-2512 and is patched in version 2.6.1.

An attacker with contributor privileges can inject malicious JavaScript that executes in the context of administrators or editors when they preview or review posts. This can lead to information disclosure, session hijacking, or other impacts typical of stored XSS vulnerabilities. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality, integrity, and availability impacts.

Upgrade the Code Embed plugin to version 2.6.1 or later, where this vulnerability is patched. Until then, restrict contributor privileges or disable the external URL embed feature to prevent exploitation. No official vendor advisory was provided, so patch status is based on the version information in the description.