Create with Code
Create with Code has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Create with Code has a vendor fix available, so running the current release closes it.
All of these findings were reported by SOPROBRO. Create with Code is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2025-24638Create with Code <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Create with Code
Author
pddring
create.withcode.uk lets you write, run, debug and share python code in your browser. This plugin lets you quickly embed your code projects in your wordpress site When you share a project from create.withcode.uk, you get a URL like: https://create.withcode.uk/embed/3C or https://create.withcode.uk/run/3C Take the last section of the URL and use it in the shortcode to embed it in your wordpress site: [withcode id="3C"] You can customise choose to display the code or run it using the mode attribute: [withcode id="3C" mode="embed"] or [withcode id="3C" mode="run"] You can also specifiy the height / width of the code snippet: [withcode id="3C" mode="embed" width="400px" height="600px"] You can customise the colour scheme by rotating all the colours on the toolbar icons by a hue value: [withcode id=”3C” hue=”45″] Or you can make the toolbar icons greyscale as follows: [withcode id=”3C” grey=”1″] Please note: This plugin just lets you embed python code from create.withcode.uk in a wordpress site. The python code can be run in an iframe in your site by pressing Ctrl + Enter to run the whole program or Ctrl + Space to run one line at a time. Python code is interpreted and run in the client’s browser: it doesn’t run on your server and it only supports a sandboxed subset of the fully python language. This is designed as a teaching and learning aid rather than a fully fledged professional development tool.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C