Preserve Code Formatting
Preserve Code Formatting has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (100%).
The one issue recorded for Preserve Code Formatting has a vendor fix available, so running the current release closes it.
All of these findings were reported by Drew Webber (mcdruid). Preserve Code Formatting is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-49386Preserve Code Formatting <= 4.0.1 - Authenticated (Contributor+) PHP Object Injection
Read the full analysisVulnerability Records

Preserve Code Formatting
Author
Scott Reilly
This plugin preserves formatting of code for display by preventing its modification by WordPress and other plugins while also retaining whitespace. NOTE: This plugin does NOT handle posts containing blocks. For such posts, use the built-in code or preformatted blocks to format your code for display. However, this plugin would still be needed if you have text-based posts from before using the blocks-based editor. NOTE: Use of the visual text editor will pose problems as it can mangle your intent in terms of code tags. I strongly suggest you not use the visual editor in conjunction with this plugin as I have taken no effort to make the two compatible. Notes: Basically, you can just paste code into code, pre, and/or other tags you additionally specify and this plugin will: Prevent WordPress from HTML-encoding text (i.e. single- and double-quotes will not become curly; “–” and “—” will not become en dash and em dash, respectively; “…” will not become a horizontal ellipsis, etc) Prevent most other plugins from modifying preserved code Prevent shortcodes from being processed Optionally preserve whitespace (in a variety of methods) Optionally preserve code added in comments Keep these things in mind: ALL embedded HTML tags and HTML entities will be rendered as text to browsers, appearing exactly as you wrote them (including any br tags). By default this plugin filters ‘the_content’ (post content), ‘the_excerpt’ (post excerpt), and ‘get_comment_text (comment content)’. Example: A post containing this within code tags: $wpdb->query(" INSERT INTO $tablepostmeta (post_id,meta_key,meta_value) VALUES ('$post_id','link','$extended') "); Would, with this plugin enabled, look in a browser pretty much how it does above, instead of like: $wpdb->query(— INSERT INTO $tablepostmeta (post_id,meta_key,meta_value) VALUES ('$post_id','link','$extended') ―); Links: Plugin Homepage | Plugin Directory Page | GitHub | Author Homepage
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C