Preserve Code Formatting

Preserve Code Formatting has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (100%).

The one issue recorded for Preserve Code Formatting has a vendor fix available, so running the current release closes it.

All of these findings were reported by Drew Webber (mcdruid). Preserve Code Formatting is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSHigh
7.5/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Preserve Code Formatting vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2025-49386

Preserve Code Formatting <= 4.0.1 - Authenticated (Contributor+) PHP Object Injection

Read the full analysis

Vulnerability Records

1 records
Preserve Code Formatting banner
Latestv5.0

Preserve Code Formatting

Scott Reilly

Author

Scott Reilly

4.7(3)
94/100
Last Updated
2025-08-15 (1y ago)
Active Installs
400+
Downloads
49,730
Requires WP
5.5+
Requires PHP
0+
Tested up to
WP 6.8.8
Created
2005-04-14 (22y ago)

This plugin preserves formatting of code for display by preventing its modification by WordPress and other plugins while also retaining whitespace. NOTE: This plugin does NOT handle posts containing blocks. For such posts, use the built-in code or preformatted blocks to format your code for display. However, this plugin would still be needed if you have text-based posts from before using the blocks-based editor. NOTE: Use of the visual text editor will pose problems as it can mangle your intent in terms of code tags. I strongly suggest you not use the visual editor in conjunction with this plugin as I have taken no effort to make the two compatible. Notes: Basically, you can just paste code into code, pre, and/or other tags you additionally specify and this plugin will: Prevent WordPress from HTML-encoding text (i.e. single- and double-quotes will not become curly; “–” and “—” will not become en dash and em dash, respectively; “…” will not become a horizontal ellipsis, etc) Prevent most other plugins from modifying preserved code Prevent shortcodes from being processed Optionally preserve whitespace (in a variety of methods) Optionally preserve code added in comments Keep these things in mind: ALL embedded HTML tags and HTML entities will be rendered as text to browsers, appearing exactly as you wrote them (including any br tags). By default this plugin filters &#8216;the_content’ (post content), &#8216;the_excerpt’ (post excerpt), and &#8216;get_comment_text (comment content)’. Example: A post containing this within code tags: $wpdb->query(" INSERT INTO $tablepostmeta (post_id,meta_key,meta_value) VALUES ('$post_id','link','$extended') "); Would, with this plugin enabled, look in a browser pretty much how it does above, instead of like: $wpdb->query(— INSERT INTO $tablepostmeta (post_id,meta_key,meta_value) VALUES ('$post_id','link','$extended') &#8213;); Links: Plugin Homepage | Plugin Directory Page | GitHub | Author Homepage

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C