Stored Cross-Site Scripting Vulnerability in Post Snippets Plugin by WordPress

CVE-2026-7430

What is CVE-2026-7430?

The Post Snippets plugin for WordPress has a vulnerability that allows authenticated attackers with Administrator-level access to execute arbitrary web scripts through a malicious import file. This issue arises from the inadequate escaping of imported snippet content when rendered within JavaScript variables in the post editor. Specifically, the jqueryUiDialog() method does not properly escape double quotes, enabling attackers to manipulate JavaScript contexts. Consequently, when snippets are imported, they can bypass essential security measures like wp_magic_quotes(), which typically protects against such injections. However, this vulnerability is not present in single-site installations, as administrators possess the unfiltered_html capability.

References