CVE-2026-7430: Post Snippets WordPress Plugin Stored XSS Vulnerability

Technical summary

The vulnerability stems from insufficient output escaping in the `jqueryUiDialog()` method within `WPEditor.php`. When snippet content is imported via the Import/Export feature, the plugin embeds it directly into JavaScript string literals without proper escaping of double-quote characters. The relevant quote-escaping code on line 214 is commented out, and imported content bypasses WordPress's `wp_magic_quotes()` sanitization. This allows a double quote in malicious snippet content to break the JavaScript string context and inject arbitrary code. The XSS payload executes with the privilege level of the accessing administrator and persists in the stored snippets, triggering on every editor load.

Business impact

The attack surface is limited to multisite WordPress installations where administrators may not already possess `unfiltered_html` capability. On affected multisite networks, a rogue administrator can inject persistent malicious scripts that execute whenever peer administrators access the post editor, potentially stealing session tokens, modifying post content, or redirecting users to malicious sites. The reputational and operational risk depends on the sensitivity of content managed through the affected installation and the number of administrators who may be compromised.

Affected systems

The Post Snippets plugin in versions up to and including 4.0.19 is vulnerable. WordPress multisite installations are at risk; single-site installations are not affected because administrators on single sites already have unrestricted `unfiltered_html` capability. The vulnerability requires an attacker to have Administrator-level or higher access to the WordPress installation.

Exploitability

Exploitation requires Administrator-level access and involves uploading a malicious import file via the plugin's Import/Export feature. The attack does not require user interaction beyond an administrator's normal workflow of accessing the post editor. The CVSS score of 4.4 reflects the high privilege requirement (PR:H) and high complexity (AC:H), which substantially limits the practical threat; however, insider threats or compromised admin accounts elevate concern. The vulnerability is not currently tracked as actively exploited in the wild.

Remediation

Update the Post Snippets plugin to a patched version released after 2026-06-17 (verify against the vendor advisory for the exact version number). For multisite installations unable to patch immediately, consider disabling the Import/Export feature or restricting administrator role assignment to trusted users only. Review recent snippet imports in your installation logs to detect any suspicious activity or injected code.

Patch guidance

Check the official Post Snippets plugin repository for an update addressing this XSS vulnerability. The patch should re-enable or properly implement quote escaping in the `jqueryUiDialog()` method. Apply the update to all affected multisite installations. Single-site installations do not require action from a security perspective, though patching is recommended for defense-in-depth and to prevent future issues.

Detection guidance

Monitor WordPress multisite installations for unexpected changes to snippet content, particularly around special characters (quotes, backslashes, or JavaScript syntax) in imported snippets. Check editor activity logs to identify which administrators accessed posts after suspicious imports. Use a Web Application Firewall (WAF) configured to detect JavaScript injection patterns in POST requests to `/wp-admin/post.php` or similar editor endpoints. Inspect the Post Snippets database tables for snippets containing obfuscated or encoded JavaScript.

Why prioritize this

Although the CVSS score is moderate (4.4), this vulnerability poses a direct persistence and lateral-privilege-threat risk in multisite environments. The ability for an attacker with admin access to inject code that affects peer administrators makes this relevant for insider-threat programs and compromise-assessment scenarios. Multisite WordPress operators managing sensitive content or multiple administrative users should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 4.4 (MEDIUM) reflects the high privilege barrier (PR:H—Administrator access required), high attack complexity (AC:H), and limited scope (only multisite WordPress installations are affected). Confidentiality and Integrity are impacted (C:L, I:L), but Availability is not (A:N). The score does not account for the insider-threat context or persistence implications; organizations with strict role-based access controls and low admin-turnover may score this lower, while those with many administrators or third-party admin accounts may justify higher internal risk ratings.

Frequently asked questions