CVE-2026-6809
Stored XSS in WordPress Social Post Embed Plugin Threads Handler
Publication date: 2026-04-28
Last updated on: 2026-04-28
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_social_post_embed | plugin | to 2.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via Stored Cross-Site Scripting. This can lead to unauthorized access or manipulation of user data when users access the injected pages.
Such unauthorized script execution can potentially compromise the confidentiality and integrity of user data, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.
However, the provided information does not explicitly state the direct impact on compliance with these standards.
Can you explain this vulnerability to me?
The Social Post Embed plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its Threads embed handler in all versions up to and including 2.0.1.
This vulnerability exists because the plugin does not properly sanitize or escape user-supplied URLs, allowing attackers to inject malicious scripts.
Authenticated users with Contributor-level access or higher can exploit this to insert arbitrary web scripts that execute when other users view the affected pages.
How can this vulnerability impact me? :
This vulnerability can allow attackers with Contributor-level access to inject malicious scripts into pages viewed by other users.
Such scripts can lead to theft of user credentials, session hijacking, or unauthorized actions performed on behalf of users.
Because the vulnerability has a CVSS base score of 6.4 with low attack complexity and no user interaction required, it poses a significant risk to site security and user data confidentiality.