What is the CVSS score of CVE-2026-7430?

CVE-2026-7430 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Post Snippets CVE-2026-7430

EUVD-2026-33246 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-29 Wordfence

GHSA-8v38-ppcg-cmjm

XSS PHP WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 03:42 vuln.today

CVE Published

May 29, 2026 - 02:27 nvd

MEDIUM 4.4

DescriptionCVE.org

The Post Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.0.19. This is due to insufficient output escaping of imported snippet content when rendering JavaScript variables in the post editor. Specifically, the jqueryUiDialog() method in WPEditor.php embeds snippet content directly into JavaScript string literals without escaping double quotes (the quote-escaping code on line 214 is commented out). When snippets are imported via the Import/Export feature, the content bypasses WordPress's wp_magic_quotes() (which would otherwise add protective backslashes), allowing double quotes in snippet content to break out of the JavaScript string context. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via a malicious import file that execute whenever any administrator accesses a post editor page. Please note that this does not affect single-site installations as administrators already have the unfiltered_html capability.

AnalysisAI

Stored Cross-Site Scripting in the Post Snippets WordPress plugin (≤4.0.19) allows authenticated administrators on multisite installations to inject persistent JavaScript into the post editor via a crafted import file, exploiting a commented-out quote-escaping routine in WPEditor.php. The injected payload executes silently in the browser of any administrator who subsequently opens any post editor page, enabling session hijacking or further lateral movement within the multisite network. No public exploit identified at time of analysis; real-world impact is bounded by the Administrator-level access prerequisite and the explicit exclusion of single-site WordPress installations.

Technical ContextAI

The flaw resides in the jqueryUiDialog() method of WPEditor.php (CPE: cpe:2.3:a:saadiqbal:post_snippets_-_custom_wordpress_code_snippets_customizer:*:*:*:*:*:*:*:*), where snippet content is interpolated directly into JavaScript string literals rendered in the WordPress post editor without sanitization. The quote-escaping logic originally present at line 214 was commented out, leaving double-quote characters in snippet content able to terminate the surrounding JS string and inject arbitrary code. The Import/Export subsystem in DBTable.php compounds this by accepting import data that bypasses WordPress core's wp_magic_quotes() mechanism - the protective backslash insertion that would otherwise neutralize injected quotes never fires for imported content. CWE-79 (Improper Neutralization of Input During Web Page Generation / Stored XSS) accurately describes the root cause: untrusted data reaches an output context (JavaScript string literal) without context-appropriate encoding. The fix is confirmed present in tagged release 4.1.1 in the WordPress plugin repository.

RemediationAI

Upgrade Post Snippets to version 4.1.1 or later, which restores or corrects the double-quote escaping in WPEditor.php; the fix is confirmed present in the WordPress plugin repository at plugins.trac.wordpress.org/browser/post-snippets/tags/4.1.1/src/PostSnippets/WPEditor.php (lines 221 and 227). Update via the WordPress admin dashboard under Plugins > Installed Plugins > Update, or via WP-CLI with wp plugin update post-snippets. For multisite administrators who cannot patch immediately, restrict access to the Post Snippets Import/Export feature to the minimum set of trusted super-administrators, and audit the existing snippet database for any content containing unescaped double quotes or suspicious JavaScript patterns. Disabling the Import/Export feature entirely until patching is completed removes the primary exploitation path without affecting existing snippet functionality. Note that single-site installations require no action.