Stored Cross-Site Scripting Vulnerability in Post Snippets Plugin for WordPress

CVE-2026-77871

What is CVE-2026-77871?

The Post Snippets plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level access and above to exploit insufficient input sanitization and output escaping through shortcode attributes. Attackers can inject arbitrary scripts into web pages, which are executed whenever a user accesses the manipulated page. This occurs because entity-encoded payloads can bypass the standard sanitization provided by WordPress, as the 'kses' function does not decode HTML entities until render time within the plugin's shortcode filter, thus leading to the potential execution of harmful scripts. Ensuring proper security measures and updating to the latest plugin version are crucial to mitigate this risk.

References