CodePen Embedded Pens Shortcode
CodePen Embedded Pens Shortcode has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for CodePen Embedded Pens Shortcode has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. CodePen Embedded Pens Shortcode is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.6.7.
CVE-2024-50440CodePen Embedded Pens Shortcode <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
CodePen Embedded Pens Shortcode
Author
Chris Coyier
Allows the use of a special shortcode [codepen_embed] for embedding Pens from CodePen. You can learn more about CodePen here and about this plugin here. Basic Usage [codepen_embed height=300 theme_id=1 slug_hash='jwGBh' user='arasdesign' default_tab='html' animations='run'] See the Pen <a href='https://codepen.io/arasdesign/pen/jwGBh'>Flat minion</a> by Amin Poursaied (<a href='https://codepen.io/arasdesign'>@arasdesign</a>) on <a href='https://codepen.io'>CodePen</a> [/codepen_embed] The Point You can use shortcodes in the “Visual” editor. CodePen Embeds are copy-and-paste HTML that don’t work when using the editor that way. If you ever use the Visual editor in WordPress, you’ll probably want to use this plugin. You can set a default theme, or override any theme set via Shortcode attribute. Hopefully eventually this plugin will have more functionality. Like have a fancy UI for picking Pens to embed and more control over the HTML output.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C