CVE-2026-12980
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Post Snippets WordPress plugin through version 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
Risk Assessment
Injected scripts can lead to data theft, session hijacking, or malware distribution among users viewing the content.
Recommendation
Update the Post Snippets plugin to a version newer than 4.2.4, which includes the security fix.
Other vulnerabilities in Post Snippets
Original NVD description (English source)
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS