CVE-2026-12980 — Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor …
Published: 2026-10-11 · CVSS: 6.8 · CVSS 3.1
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7