CVE-2024-10814mediumCWE-918

CVE-2024-10814: medium-severity vulnerability in dartiss Code Embed

Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery

Published · Updated

Follow this CVE+ Monitor Code Embed

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.3%
The Code Embed plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5 via the ce_get_file() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected products
dartiss · Code Embed
Related CVEs — dartiss Code Embed

In the same product, most dangerous first.

CVE-2024-8804MEDIUMCode Embed <= 2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-2512MEDIUMCode Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom FieldsEPSS 0.2%