Social Post Embed
Social Post Embed has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Social Post Embed has a vendor fix available, so running the current release closes it.
All of these findings were reported by hxuu. Social Post Embed is installed on roughly 40 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-6809Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed
Read the full analysisVulnerability Records
Social Post Embed
Author
David Artiss
A temporary plugin solution to add embedding of various social media platform posts, until such time that they become of WordPress Core. At this moment this plugin will support embedding of Threads and Spoutible posts. Using the plugin is incredibly simple. Once it’s installed and activated… Head to your social media conversation and click on the option to copy a link to it (or just grab the URL from the browser) You should be able to paste that link straight into a post and it will appear as an embed There are no additional parameters that you can specify, and the embed appears as specified by their originating sites. Iconography is courtesy of the very talented Shawon. Please visit the Github page for the latest code development, planned enhancements and known issues Please Note: This plugin makes use of external scripts, to provide the embedding, all of which are provided by the originating website (rather than a third-party solution). These are… Threads (part of Meta). Their privacy policy can be found here. Spoutible. The Privacy Policy is here.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C