Atomic Edge analysis of CVE-2026-6809: This vulnerability is a Stored Cross-Site Scripting (XSS) in the Social Post Embed plugin for WordPress, affecting all versions up to and including 2.0.1. The plugin’s Threads embed handler does not sanitize or escape user-supplied URL input, allowing authenticated users with Contributor-level access or higher to inject arbitrary web scripts. The CVSS score is 6.4 (Medium).

The root cause is in the file `/social-post-embed/inc/threads.php`. The vulnerable code fails to sanitize the user-supplied `$threads_url` variable before extracting the username and full URL via regex. Specifically, lines 48-49 in the vulnerable version assign `$user = $split[1]` and `$url = $split[0]` without any escaping. The `$url` variable is later used in an embed script output without proper escaping, as seen in line 61 where `$threads_url` is output directly within an iframe or script tag. The regex only validates the URL format but does not strip malicious characters.

An attacker authenticated as a Contributor or higher can create a post or page and use the Threads embed shortcode (e.g., `[threads url=”PAYLOAD”]`) with a crafted URL that contains JavaScript. For example, providing `https://www.threads.net/@”+alert(1)+”/post/abc` would cause the stored embed to execute JavaScript when the page is rendered. The attack vector is through the WordPress post editor, where the attacker inserts the malicious shortcode or block, which is then saved to the database and executed for any visitor viewing the post.

The patch in version 2.0.2 adds `esc_attr()` to both `$user` and `$url` variables in `threads.php` (lines 48-49), and also applies `esc_url()` to `$threads_url` on line 60. `esc_attr()` encodes HTML special characters for safe use in attributes, while `esc_url()` strips dangerous protocols and encodes special characters. This prevents injected JavaScript from rendering as executable code. The version number was also incremented from 2.0.1 to 2.0.2.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the affected page. This can lead to session hijacking, theft of sensitive cookies or authentication tokens, redirection to malicious sites, defacement, or further phishing attacks. Since the XSS is stored, it affects all visitors to the WordPress site, including administrators.