EUVD-2026-24692Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Text Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ts shortcode in all versions up to, and including, 0.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting (XSS) in the Text Snippets plugin for WordPress up to version 0.0.1 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via unsanitized shortcode attributes, which executes whenever any user visits the affected page. The vulnerability stems from insufficient input sanitization and output escaping on the ts shortcode, enabling persistent payload injection. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The Text Snippets plugin for WordPress implements a ts shortcode that accepts user-supplied attributes without proper sanitization or escaping. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a foundational XSS class. The shortcode processes and outputs attribute data directly into the page HTML context without converting special characters (e.g., converting < to <) or validating input structure. WordPress's native escaping functions (such as esc_attr() or wp_kses_post()) appear not to have been applied to the shortcode attribute output. CPE cpe:2.3:a:snedled:text_snippets:*:*:*:*:*:*:*:* identifies all versions of the plugin as affected through version 0.0.1.
RemediationAI
Update the Text Snippets plugin to a patched version immediately if available from the plugin author via the WordPress plugin repository. If no patch has been released, disable the plugin entirely via the WordPress admin panel (Plugins > Installed Plugins > Deactivate). As a temporary compensating control pending patch availability, WordPress administrators can restrict contributor-level access to only trusted, verified users by reviewing and modifying user roles under Users > All Users in the WordPress admin; however, this reduces site functionality for legitimate contributors. Alternatively, if the ts shortcode is not actively used on the site, remove all instances of [ts ...] from page and post content, or block the shortcode registration via a code snippet in functions.php: remove_shortcode( 'ts' );. Check the Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc7a0f3-6a58-4e42-9341-aecf55d2ccb1) for patch availability updates and the WordPress plugin repository for updated versions.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today