Skip to content
Sign in
6.8 Medium

CVE-2026-12980 The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets…

Description

The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.

Affected products and versions

Product Affected versions Fixed in
Post Snippets 4.2 earliest → 4.2.4 No fix stated

Other CVEs of Post Snippets

The 2 CVEs of Post Snippets →
CVE-2021-25010 The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make… Not rated
Track this CVE