Post Snippets EUVD-2026-33246

Four concrete conditions must all be satisfied: (1) WordPress Multisite installation - the CVE explicitly states single-site installs are unaffected because administrators hold unfiltered_html natively; (2) Attacker holds Administrator-level (or higher) WordPress account, confirmed by CVSS PR:H - lower-privileged roles such as Editor or Author cannot access the Import/Export feature; (3) Post Snippets plugin version 4.0.19 or earlier is active, with the quote-escaping code at WPEditor.php line 214 commented out; (4) A victim administrator must open a post editor page after the malicious snippet has been imported - UI:N in the CVSS applies to the attacker's own action (no interaction needed to import), but victim interaction (opening the editor) is the trigger mechanism for payload delivery to the victim. Limiting factors: the high privilege bar (Administrator) for the attacker dramatically reduces the realistic attacker population; multisite-only scope limits impact to a subset of WordPress deployments; and payload execution requires a separate administrator to open the editor post-import.

CVSS 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) accurately captures the constrained attack surface. PR:H confirms Administrator-level authentication is required, and AC:H signals additional complexity - consistent with the multisite-only applicability and the need to exploit a specific import pathway. The Scope:Changed metric (S:C) is significant: injected scripts execute in victim-administrator sessions, meaning the attacker's payload can affect browser contexts beyond their own account. However, real-world risk is sharply bounded by two factors: the attacker must already hold Administrator credentials, and the vulnerability is explicitly inapplicable to single-site WordPress installs where administrators possess the unfiltered_html capability. No EPSS data was provided, so exploitation probability cannot be quantified from available signals. The vulnerability is not listed in CISA KEV, and no public POC has been identified at time of analysis. This is best treated as a moderate-priority finding in multisite environments - the Scope:Changed and persistent nature warrant patching promptly, but the high privilege bar and scoped applicability prevent this from being an urgent emergency for most WordPress operators.

An Administrator-level account holder on a WordPress multisite network - such as a compromised or malicious admin - crafts a Post Snippets import file (.json or equivalent) in which snippet content contains a double-quote sequence that breaks out of the JavaScript string context rendered by jqueryUiDialog(). The attacker imports this file via the Post Snippets Import/Export UI; because wp_magic_quotes() does not process the import pathway, the raw double quote is stored in the database. Subsequently, any administrator on the network who opens any post editor page triggers execution of the injected script in their browser, enabling the attacker to exfiltrate session cookies, perform actions as that administrator, or propagate the payload further across the multisite network.