CVE-2026-7430

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the WordPress Post Snippets plugin in all versions up to and including 4.0.19. The flaw resides in the jqueryUiDialog() method of WPEditor.php, where imported snippet content is embedded directly into JavaScript string literals without proper escaping of double quotes; the intended quote-escaping code on line 214 is commented out [1][2]. When snippets are imported via the Import/Export feature, the content bypasses WordPress's wp_magic_quotes() protection, allowing double quotes to break out of the JavaScript string context [description].

Exploitation

An attacker must be an authenticated Administrator-level user (or above). The attacker imports a malicious file containing crafted snippet content that includes double quotes to break out of the JavaScript string. Once imported, the malicious snippet is stored and will execute as a script whenever any administrator accesses a post editor page that triggers the snippet [description]. On multisite installations, affected administrators do not possess the unfiltered_html capability, making the attack viable [description].

Impact

Successful exploitation allows the attacker to inject arbitrary web scripts into the post editor context. This can lead to session hijacking, defacement, or redirection to malicious sites, all within the victim's browser session. The injected script executes under the privileges of the administrator viewing the post editor [description].

Mitigation

The issue is fixed in version 4.1.1 as indicated by the corrected escaping code [3][4]. Users should immediately update the Post Snippets plugin to version 4.1.1 or later. For sites where updating is not immediately possible, administrators should restrict Import/Export functionality to trusted users only. This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.