Stored Cross-Site Scripting in Text Snippets Plugin for WordPress

CVE-2026-5748

What is CVE-2026-5748?

The Text Snippets plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes within the ts shortcode. This vulnerability enables authenticated users with contributor-level access to inject and execute arbitrary web scripts on any page where the injected content resides. As a result, visiting these pages could expose users to malicious scripts, posing significant security risks. It is crucial for site administrators to review and update their plugin versions to mitigate potential attacks.

References