Security
Loading…

CVE-2026-12980

MEDIUMCVSS 6.8
View on NVD← Back to search
Description

The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.

Timeline
Published:October 11th, 2026 7:17 AM
Last modified:October 11th, 2026 12:16 PM
CVSS Scoring

CVSS v3: 6.8 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)
CWE-79
References & Reports
Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute