Post Snippets CVE-2026-77871

Exploitation requires an authenticated WordPress account at contributor level or above (PR:L confirmed in CVSS), and the plugin's snippet shortcodes must be enabled - the description explicitly states 'This requires snippet shortcodes to be enabled.' The specific mechanism is that an entity-encoded payload (e.g. <script>...</script>) placed in a snippet shortcode attribute bypasses wp_kses_post because kses does not decode HTML entities, and the plugin's own shortcode filter converts it back to executable HTML at render time. Limiting factors: the attacker must already hold contributor+ privileges (not anonymous), shortcodes must be active, and payload execution depends on another user subsequently viewing the injected page.

This is a stored Cross-Site Scripting (CWE-79) flaw with a moderate CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The network attack vector and low complexity are real, but the PR:L metric confirms exploitation requires an authenticated account at contributor level or above, which meaningfully narrows the attacker population to users already granted content-authoring rights on the site. The scope-change flag (S:C) and the dual C:L/I:L impacts reflect that injected script executes in the browser context of other users - including higher-privileged administrators - when they view the affected page, which is the main reason this rises above a trivial self-XSS. No EPSS score, KEV listing, or working exploit was supplied in the input, and the vuln.today decision label is 'this_month' rather than act_now or emergency - together these signals point to a genuine but non-urgent, patch-in-routine-cycle issue rather than a widespread or actively exploited threat. The one point of nuance worth verifying: exploitation is gated on snippet shortcodes being enabled, a plugin configuration condition not captured by the CVSS vector, so the raw score may overstate risk for deployments that do not use shortcodes.

A user with contributor-level (or higher) access on a WordPress site running this plugin, with snippet shortcodes enabled, saves a snippet containing an entity-encoded payload such as <script>...</script>. The payload survives WordPress's wp_kses_post save-time sanitization because kses does not decode HTML entities, and the plugin's own shortcode filter decodes it back into live markup at render time; when an administrator or visitor later views the page, the script executes in their browser. No public working exploit was identified in the provided data.