Security Alert Summary
The Post Snippets plugin for WordPress (all versions up to and including 4.0.19) contains a stored cross-site scripting (XSS) vulnerability that can allow authenticated administrators to inject JavaScript into the post editor via the Import/Export feature. A malicious import file can include snippet content that breaks out of a JavaScript string literal and executes when an administrator opens the post editor.
CVE Details
- CVE ID: CVE-2026-7430
- Affected component: Post Snippets plugin for WordPress
- Affected versions: All versions up to and including 4.0.19
- Published: May 29, 2026 at 4:17 AM
- Last modified: May 29, 2026 at 1:09 PM
- CVSS v3.1 base score: 4.4 (MEDIUM)
- CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges: Authentication required. Description states authenticated attackers with Administrator-level access and above; CVSS privileges required = HIGH
- User interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This vulnerability is a stored Cross-Site Scripting (XSS) issue in the Post Snippets plugin. The root cause is insufficient output escaping of imported snippet content when the plugin renders JavaScript variables in the post editor. Specifically, the jqueryUiDialog() method in WPEditor.php embeds snippet content directly into JavaScript string literals without escaping double quotes; the description indicates the quote-escaping code on line 214 is commented out. When snippets are imported via the Import/Export feature, the content can bypass WordPress’ wp_magic_quotes() behavior (which would otherwise add protective backslashes), allowing double quotes in snippet content to break out of the JavaScript string context.
The practical effect is that a malicious import file can store a payload which executes arbitrary web scripts whenever any administrator opens a post editor page. The description also notes this issue does not affect single-site installations because administrators on those sites already have the unfiltered_html capability.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who edit content, and an external contractor who imports content or snippets. If an attacker supplies a crafted import file and an administrator with the ability to import snippets applies it, the injected script can execute in the context of the post editor. This could lead to disclosure of internal information accessible in the editor or browser context, and increase the risk of targeted phishing or social engineering against staff or contractors whose email addresses or other details are accessible on the site.
The impact aligns with the CVSS assessment: disclosure or modification of limited data (low confidentiality and integrity impacts) rather than full site takeover. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and editor roles that can import or edit snippets.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins, and restrict import abilities to trusted users.
- Monitor site activity and logs for unusual behavior following any imports or changes to snippets.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.0.19/src/PostSnippets/DBTable.php#L114
- https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.0.19/src/PostSnippets/WPEditor.php#L218
- https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.1.1/src/PostSnippets/WPEditor.php#L20
- https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.1.1/src/PostSnippets/WPEditor.php#L221
- https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.1.1/src/PostSnippets/WPEditor.php#L227
- https://plugins.trac.wordpress.org/browser/post-snippets/trunk/src/PostSnippets/DBTable.php#L114
- https://plugins.trac.wordpress.org/browser/post-snippets/trunk/src/PostSnippets/WPEditor.php#L218
- https://www.wordfence.com/threat-intel/vulnerabilities/id/59dc2448-491c-478f-a784-c727057b126b?source=cve
