Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · post-snippets
Post Snippets
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 28, 2026Post Snippets – Custom WordPress Code Snippets Customizer: Stored Cross-Site ScriptingCVE-2026-77871 · affects up to 4.2.4 · reported by WordfenceMedium 6.4
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Entity-encoded payloads such as <script>...</script> survive WordPress's wp_kses_post on-save sanitization because kses does not decode HTML entities, and are only converted back into executable HTML tags at render time by the plugin's own shortcode filter. This requires snippet shortcodes to be enabled.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2026Post Snippets: Does not properly escape variable values substituted into snippets before outputting themCVE-2026-12980 · affects up to 4.2.4 · reported by WPScanMedium 6.8
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
Jun 25, 2026Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.CVE-2026-56049 · affects up to 4.0.19 · reported by PatchstackHigh 8.5
Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.
May 29, 2026Post Snippets: Stored Cross-Site ScriptingCVE-2026-7430 · affects up to 4.0.19 · reported by WordfenceMedium 4.4
The Post Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.0.19. This is due to insufficient output escaping of imported snippet content when rendering JavaScript variables in the post editor. Specifically, the `jqueryUiDialog()` method in `WPEditor.php` embeds snippet content directly into JavaScript string literals without escaping double quotes (the quote-escaping code on line 214 is commented out). When snippets are imported via the Import/Export feature, the content bypasses WordPress's `wp_magic_quotes()` (which would otherwise add protective backslashes), allowing double quotes in snippet content to break out of the JavaScript string context. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via a malicious import file that execute whenever any administrator accesses a post editor page. Please note that this does not affect single-site installations as administrators already have the `unfiltered_html` capability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026Post Snippets: Improper Control of Generation of Code ('Code Injection')CVE-2026-25001 · affects up to 4.0.12 · reported by PatchstackHigh 8.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through <= 4.0.12.
Dec 31, 2025Post Snippets: Cross-Site Request Forgery (CSRF)CVE-2025-63040 · affects up to 4.0.11 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Post Snippets post-snippets allows Cross Site Request Forgery.This issue affects Post Snippets: from n/a through <= 4.0.11.
Aug 8, 2023Auth.CVE-2023-25459 · fixed in 4.0.3 · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Postsnippets Post Snippets plugin <= 4.0.2 versions.
Feb 28, 2022Post Snippets: Does not have CSRF checkCVE-2021-25010 · fixed in 3.1.4 · reported by WPScanCritical 9.6
The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.