CVE-2026-77871— Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Quick assessment
Affected
saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件"Post Snippets – Custom WordPress Code Snippets Customizer"在所有 4.2.4 及更早版本中，存在通过短代码属性触发的存储型跨站脚本（Stored XSS）漏洞，原因是输入清洗和输出转义不足。该漏洞允许拥有“贡献者”权限或更高权限的已认证攻击者，在页面中注入任意 Web 脚本；当用户访问被注入的页面时，这些脚本将被执行。 由于 WordPress 的 保存时清洗机制不会解码 HTML 实体，因此像 这类经过实体编码的载荷能够绕过该清洗
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77871
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Source: CVE Program / CVE List V5
Vulnerability Description
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Entity-encoded payloads such as <script>...</script> survive WordPress's wp_kses_post on-save sanitization because kses does not decode HTML entities, and are only converted back into executable HTML tags at render time by the plugin's own shortcode filter. This requires snippet shortcodes to be enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| saadiqbal | Post Snippets – Custom WordPress Code Snippets Customizer | 0 ~ 4.2.4 | - |
|
II. Public POCs for CVE-2026-77871
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77871
请登录查看更多情报信息。
Other References for CVE-2026-77871 (10)
IV. Related Vulnerabilities
Same vendor: saadiqbal
-
CVE-2026-75962
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross- -
CVE-2026-12739
WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticate -
CVE-2026-17149
myCred – Points Management System For Gamification, Ranks, B -
CVE-2026-15009
Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scrip -
CVE-2026-6627
WPFormify <= 1.1.1 - Missing Authorization
Same weakness: CWE-79
-
CVE-2026-16020
Stored XSS Fazile BACAK's DefterAsist Financial Advisor Plat -
CVE-2026-101935
Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scrip -
CVE-2026-109975
Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored -
CVE-2026-118169
Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cros -
CVE-2026-109370
Document Embedder <= 2.4.0 - Authenticated (Contributor+) St