medium6.8
CVE-2026-12980
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with…
Impact
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
Affected products
| Product | Affected versions |
|---|---|
| Post Snippets WordPress Plugin | through 4.2.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.