CVE-2026-12980

Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable

The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.

Affected

Post Snippets

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.29% chance of exploitation in the next 30 days, 20th percentile

Published

2026-10-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/288d419a-9e27-45ae-bde1-1aef52532354/

References

• CVE Record
• NVD entry