CVE-2026-12980: Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable

Q: Who can exploit this issue?

A user with the WordPress Contributor role or a higher-privileged role can exploit it by supplying malicious values for snippet variables.

Q: When does the injected script execute?

The script executes when content containing the affected snippet output is viewed. Exploitation therefore requires a viewer to load the affected content.

Q: Are low-privileged or unauthenticated attackers able to exploit it directly?

No. The provided CVSS vector indicates high privileges are required, and the advisory specifically identifies Contributor-level access or above.

Q: Which versions are affected?

Post Snippets versions through 4.2.4 are affected. The provided information does not identify a fixed version.

Published Oct 11, 2026

Updated

The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.

Affected Software

1 affected component

Post Snippets Post Snippets<=4.2.4

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with the WordPress Contributor role or a higher-privileged role can exploit it by supplying malicious values for snippet variables.

When does the injected script execute?

The script executes when content containing the affected snippet output is viewed. Exploitation therefore requires a viewer to load the affected content.

Are low-privileged or unauthenticated attackers able to exploit it directly?

No. The provided CVSS vector indicates high privileges are required, and the advisory specifically identifies Contributor-level access or above.

Which versions are affected?

Post Snippets versions through 4.2.4 are affected. The provided information does not identify a fixed version.

CVE-2026-12980: Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the injected script execute?

Are low-privileged or unauthenticated attackers able to exploit it directly?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the injected script execute?

Are low-privileged or unauthenticated attackers able to exploit it directly?

Which versions are affected?