Post Snippets <= 4.0.19 Stored XSS via Import (CVE-2026-7430)

Vulnerability Overview Vulnerability Name: Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import CVE ID: CVE-2026-7430 CVSS Score: 4.4 (Medium) Published Date: May 28, 2026 Last Updated Date: May 29, 2026 Researcher: x1abxids Affected Scope Software Type: Plugin Software Name: Post Snippets – Custom WordPress Code Snippets Customizer Affected Versions: <= 4.0.19 Fixed Version: 4.1.1 Remediation Fix Method: Update to version 4.1.1 or later patched version Vulnerability Description The Post Snippets plugin suffers from a Stored Cross-Site Scripting (XSS) vulnerability when importing code snippets containing JavaScript variables, due to improper escaping of double quotes. Attackers can execute arbitrary JavaScript code by importing malicious code snippets, which triggers when an administrator accesses the post editor page. References plugins.trac.wordpress.org Additional Information Disclaimer: The content of this page is copyrighted and may not be copied, distributed, or modified without permission. Contact: If there are any errors or if you need more information, please contact support@wordfence.com. Recent Vulnerabilities Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.12 - Authenticated (Contributor+) Remote Code Execution - CVE ID: CVE-2025-25001 - CVSS Score: 8.8 - Researcher: Doan Dinh Van (BenVan53) - Published Date: March 16, 2026 Post Snippets <= 4.0.11 - Cross-Site Request Forgery - CVE ID: CVE-2025-63040 - CVSS Score: 4.3 - Researcher: Nabil Irwan - Published Date: December 31, 2025 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get - CVE ID: CVE-2023-33999 - CVSS Score: 6.1 - Researcher: Rafie Muhammad - Published Date: July 18, 2023 Post Snippets <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'snippet_content' - CVE ID: CVE-2023-25459 - CVSS Score: 4.4 - Researcher: Abdi Pranata - Published Date: May 9, 2023 Freemius SDK <= 2.4.2 - Missing Authorization Checks - CVE ID: CVE-2022-4974 - CVSS Score: 6.3 - Researcher: Muhammad Adel - Published Date: March 4, 2022 Post Snippets <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting - CVE ID: CVE-2021-25010 - CVSS Score: 9.6 - Researcher: Muhammad Adel - Published Date: January 31, 2022 Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update - CVE ID: CVE-2021-25010 - CVSS Score: 8.8 - Researcher: Muhammad Adel - Published Date: February 25, 2019 Additional Information Disclaimer: The content of this page is copyrighted and may not be copied, distributed, or modified without permission. Contact: If there are any errors or if you need more information, please contact support@wordfence.com. Recent Vulnerabilities Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.12 - Authenticated (Contributor+) Remote Code Execution - CVE ID: CVE-2025-25001 - CVSS Score: 8.8 - Researcher: Doan Dinh Van (BenVan53) - Published Date: March 16, 2026 Post Snippets <= 4.0.11 - Cross-Site Request Forgery - CVE ID: CVE-2025-63040 - CVSS Score: 4.3 - Researcher: Nabil Irwan - Published Date: December 31, 2025 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get - CVE ID: CVE-2023-33999 - CVSS Score: 6.1 - Researcher: Rafie Muhammad - Published Date: July 18, 2023 Post Snippets <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'snippet_content' - CVE ID: CVE-2023-25459 - CVSS Score: 4.4 - Researcher: Abdi Pranata - Published Date: May 9, 2023 Freemius SDK <= 2.4.2 - Missing Authorization Checks - CVE ID: CVE-2022-4974 - CVSS Score: 6.3 - Researcher: Muhammad Adel - Published Date: March 4, 2022 Post Snippets <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting - CVE ID: CVE-2021-25010 - CVSS Score: 9.6 - Researcher: Muhammad Adel - Published Date: January 31, 2022 Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update - CVE ID: CVE-2021-25010 - CVSS Score: 8.8 - Researcher: Muhammad Adel - Published Date: February 25, 2019 Additional Information Disclaimer: The content of this page is copyrighted and may not be copied, distributed, or modified without permission. Contact: If there are any errors or if you need more information, please contact support@wordfence.com. Recent Vulnerabilities Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.12 - Authenticated (Contributor+) Remote Code Execution - CVE ID: CVE-2025-25001 - CVSS Score: 8.8 - Researcher: Doan Dinh Van (BenVan53) - Published Date: March 16, 2026 Post Snippets <= 4.0.11 - Cross-Site Request Forgery - CVE ID: CVE-2025-63040 - CVSS Score: 4.3 - Researcher: Nabil Irwan - Published Date: December 31, 2025 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get - CVE ID: CVE-2023-33999 - CVSS Score: 6.1 - Researcher: Rafie Muhammad - Published Date: July 18, 2023 Post Snippets <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'snippet_con

Goal Reached Thanks to every supporter — we hit 100%!

Post Snippets <= 4.0.19 Stored XSS via Import (CVE-2026-7430)

More from this source