CVE-2026-77871 in Post Snippets Plugin
Summary
by MITRE • 10/28/2026
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Entity-encoded payloads such as <script>...</script> survive WordPress's wp_kses_post on-save sanitization because kses does not decode HTML entities, and are only converted back into executable HTML tags at render time by the plugin's own shortcode filter. This requires snippet shortcodes to be enabled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Post Snippets – Custom WordPress Code Snippets Customizer plugin represents a significant security risk for websites running versions up to 4.2.4 due to a stored cross-site scripting vulnerability embedded within its shortcode attribute handling mechanism. This flaw stems from insufficient input sanitization and output escaping practices during the processing of user-supplied data. The vulnerability allows authenticated attackers, specifically those with contributor-level access or higher privileges, to inject arbitrary web scripts into website pages. These injected payloads are not executed immediately upon submission but persist in the database, triggering execution whenever a legitimate user accesses a page containing the malicious shortcode. This persistence distinguishes it from reflected attacks and increases the potential for widespread impact as multiple users may inadvertently trigger the script during normal site navigation.
The technical mechanism of this exploit relies on the interaction between WordPress core security functions and the plugin's specific rendering logic. When an attacker submits a payload, they utilize entity-encoded strings such as <script></script>. Standard WordPress sanitization routines, particularly wp_kses_post, are designed to strip dangerous HTML tags but do not decode HTML entities during this process. Consequently, the encoded script tags pass through the initial security checks and are stored in their encoded form within the database. The vulnerability is realized at render time when the plugin's own shortcode filter processes these attributes. Unlike core WordPress functions that might maintain strict escaping throughout the lifecycle of data, this specific shortcode implementation converts the entity-encoded strings back into executable HTML tags before outputting them to the browser. This late-stage decoding bypasses earlier security controls, allowing malicious JavaScript to execute in the context of the victim's session.
From an operational perspective, this vulnerability facilitates persistent unauthorized code execution on compromised WordPress installations. The requirement for contributor-level access or above means that while it is not exploitable by unauthenticated users, it poses a serious threat to sites with multiple user accounts where privilege escalation or account compromise has occurred. Once executed, the injected scripts can perform various malicious actions depending on the attacker's intent. These may include stealing session cookies and authentication tokens, defacing website content, redirecting visitors to phishing pages, or installing further malware such as keyloggers or ransomware loaders. The impact is compounded by the fact that the attack targets all users who view the affected page, potentially leading to a large-scale compromise of user data if sensitive information is transmitted via unencrypted channels or if session hijacking leads to administrative access.
This vulnerability aligns with Common Weakness Enumeration CWE-79, which classifies improper neutralization of input during web page generation as cross-site scripting. The attack vector corresponds to the ATT&CK technique T1059.007, specifically JavaScript execution within a browser environment via stored payloads. To mitigate this risk, site administrators must immediately update the Post Snippets plugin to version 4.2.5 or later where these sanitization and escaping issues have been addressed. In environments where immediate updating is not feasible, implementing Web Application Firewall rules can help detect and block requests containing encoded script tags in shortcode attributes. Additionally, enforcing strict role-based access control policies ensures that only trusted administrators can create snippets with complex shortcodes, reducing the attack surface for lower-privileged users who might otherwise exploit this flaw. Regular auditing of installed plugins and adherence to secure coding standards regarding input validation and output encoding are essential preventive measures against such vulnerabilities in WordPress ecosystems.