Post Snippets
Monthly
Remote code execution in the Post Snippets WordPress plugin (versions 4.0.19 and earlier) lets an authenticated user with only Contributor-level privileges inject and execute arbitrary PHP/code on the server via the plugin's snippet-handling functionality (CWE-94). Because a low-privilege role can pivot to full server compromise with a scope change (S:C), this is a privilege-escalation-to-RCE flaw reported by Patchstack; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
The Post Snippets WordPress plugin versions up to and including 4.0.12 contain an improper code generation vulnerability (CWE-94) that enables remote code injection and execution. An attacker can exploit this flaw to execute arbitrary code on affected WordPress installations, potentially leading to complete site compromise. The vulnerability has been publicly documented by Patchstack with available references, and the attack vector appears to be network-based without requiring high privileges.
Stored cross-site scripting in the Post Snippets WordPress plugin through 4.2.4 lets an authenticated user with Contributor-level access or above inject arbitrary JavaScript through snippet variable values, which then executes in the browser of any higher-privileged user (such as an editor or administrator) who views the rendered content. The plugin substitutes variable values into snippet output without escaping them, so injected script runs in the context of the viewing user's session and can be leveraged for session or credential theft and privileged actions performed on the victim's behalf. Publicly available exploit code exists and WPScan published the vulnerability, but there is no evidence of confirmed active exploitation (the issue is not in CISA KEV); real-world exposure is limited to sites that grant Contributor or snippet-authoring access to untrusted or lower-trust users.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in the Post Snippets WordPress plugin (versions 4.0.19 and earlier) lets an authenticated user with only Contributor-level privileges inject and execute arbitrary PHP/code on the server via the plugin's snippet-handling functionality (CWE-94). Because a low-privilege role can pivot to full server compromise with a scope change (S:C), this is a privilege-escalation-to-RCE flaw reported by Patchstack; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
The Post Snippets WordPress plugin versions up to and including 4.0.12 contain an improper code generation vulnerability (CWE-94) that enables remote code injection and execution. An attacker can exploit this flaw to execute arbitrary code on affected WordPress installations, potentially leading to complete site compromise. The vulnerability has been publicly documented by Patchstack with available references, and the attack vector appears to be network-based without requiring high privileges.
Stored cross-site scripting in the Post Snippets WordPress plugin through 4.2.4 lets an authenticated user with Contributor-level access or above inject arbitrary JavaScript through snippet variable values, which then executes in the browser of any higher-privileged user (such as an editor or administrator) who views the rendered content. The plugin substitutes variable values into snippet output without escaping them, so injected script runs in the context of the viewing user's session and can be leveraged for session or credential theft and privileged actions performed on the victim's behalf. Publicly available exploit code exists and WPScan published the vulnerability, but there is no evidence of confirmed active exploitation (the issue is not in CISA KEV); real-world exposure is limited to sites that grant Contributor or snippet-authoring access to untrusted or lower-trust users.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.