This is a code I have in a function.php action. It is responsible for getting and displaying an embed code. Typically there is a youtube link from $embed_link but it comes from a public form so it can contain anything:

    $embed_link = get_post_meta( $post_id, 'user_content_link_to_remote_video' );
    $embed_code = wp_oembed_get( $embed_link[0] );
    if ($embed_code): 
        echo $embed_code;

Is there a risk of malicious code in there? Is this code safe? If not, how to make it safer?

1 Answer 1


wp_ombed_get() will only process URLs from whitelisted oEmbed providers. The list of supported providers is available here. This means the only code that can be output is embed code from those providers. These are the same providers that WordPress supports for URLs in content, or the embed block in the block editor, so you be reasonably assured that they are safe, as WordPress considers them safe enough for authors and contributors to use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.