Post Snippets CVE-2026-12980

Requires an authenticated WordPress account with the Contributor role or higher on a site running Post Snippets ≤4.2.4, plus a victim (typically a higher-privileged user such as an editor/administrator) who subsequently views the content where the snippet's unescaped variable values are rendered (UI:R). Exploitation is therefore limited to deployments that grant snippet-authoring/contributor access to untrusted or lower-trust users; sites restricting content authoring to trusted administrators are not realistically exposed. No non-default plugin setting is required beyond having the plugin active and snippets in use.

This is a stored/injected XSS (CWE-79) in the Post Snippets WordPress plugin through 4.2.4, requiring an authenticated user with Contributor role or above. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) is internally inconsistent with the description: it marks PR:H (high privilege) yet the description states Contributor-level access suffices, which is a LOW-privilege authenticated role - PR:L is more defensible. It also assigns C:H/I:H/A:H and S:U, which overstates impact for a typical reflected/stored script-injection flaw where real impact is usually limited (C:L/I:L) and scope typically changes (S:C) because the script executes in a victim's browser context. A public exploit exists (publicly available exploit code exists, reported by WPScan), but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. Net real-world risk is moderate-but-conditional: exploitation needs an authenticated contributor account AND a victim (typically an admin/editor) to view the malicious snippet output. For sites that allow untrusted contributors this is a meaningful privilege-escalation-to-admin vector; for single-author or tightly-controlled sites the practical risk is low.

A site permits untrusted users to register at Contributor level. An attacker with such an account crafts a snippet whose variable values contain unescaped JavaScript; when an administrator or editor previews or publishes content that renders the snippet, the script executes in their authenticated session. A public exploit/PoC is available via WPScan, lowering the effort to reproduce the attack.