Post Snippets Custom Wordpress Code Snippets Customizer
Monthly
Stored cross-site scripting in the WordPress plugin Post Snippets - Custom WordPress Code Snippets Customizer affects every version up to and including 4.2.4, letting a contributor-level or higher account plant script that runs in another user's browser. The bypass works because entity-encoded payloads such as <script>...</script> are not decoded by WordPress's wp_kses_post on save, and the plugin's own shortcode filter turns them back into live HTML when the page renders; the description states the snippet shortcodes must be enabled for this path to work. Rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Post Snippets WordPress plugin (≤4.0.19) allows authenticated administrators on multisite installations to inject persistent JavaScript into the post editor via a crafted import file, exploiting a commented-out quote-escaping routine in WPEditor.php. The injected payload executes silently in the browser of any administrator who subsequently opens any post editor page, enabling session hijacking or further lateral movement within the multisite network. No public exploit identified at time of analysis; real-world impact is bounded by the Administrator-level access prerequisite and the explicit exclusion of single-site WordPress installations.
Stored cross-site scripting in the WordPress plugin Post Snippets - Custom WordPress Code Snippets Customizer affects every version up to and including 4.2.4, letting a contributor-level or higher account plant script that runs in another user's browser. The bypass works because entity-encoded payloads such as <script>...</script> are not decoded by WordPress's wp_kses_post on save, and the plugin's own shortcode filter turns them back into live HTML when the page renders; the description states the snippet shortcodes must be enabled for this path to work. Rated CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Post Snippets WordPress plugin (≤4.0.19) allows authenticated administrators on multisite installations to inject persistent JavaScript into the post editor via a crafted import file, exploiting a commented-out quote-escaping routine in WPEditor.php. The injected payload executes silently in the browser of any administrator who subsequently opens any post editor page, enabling session hijacking or further lateral movement within the multisite network. No public exploit identified at time of analysis; real-world impact is bounded by the Administrator-level access prerequisite and the explicit exclusion of single-site WordPress installations.