Uncode

Uncode has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Improper Input Validation.

Every one of the 5 issues recorded for Uncode has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (3) reported by mikemyers.

01234567891017.02.2025Today17.02.20257.5Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed CVSS 7.5 · 17.02.20255.4Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description CVSS 5.4 · 17.02.20256.5Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia CVSS 6.5 · 17.02.202526.08.20256.1Uncode < 2.9.4.4 - Reflected Cross-Site Scripting CVSS 6.1 · 26.08.202527.08.20267.2Uncode <= 2.12.7 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 27.08.2026

Strategic Overview

Avg CVSSMedium
6.5/ 10
Patch Coverage100%
Open

0

Fixed

5

Get automatic notifications for all Uncode vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2024-13681

Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed

Read the full analysis

Vulnerability Records

5 records
Showing 1–5 of 5 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C