---
id: CVE-2026-12980
title: >-
  The Post Snippets  WordPress plugin through 4.2.4 does not properly escape
  variable values substituted into snippets before outputting them, allowing
  users with the Contributor role and above to inject arbitrary web scripts that
  execute …
summary: >-
  The Post Snippets  WordPress plugin through 4.2.4 does not properly escape
  variable values substituted into snippets before outputting them, allowing
  users with the Contributor role and above to inject arbitrary web scripts that
  execute …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-11'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:36:00.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12980'
references:
  - url: 'https://wpscan.com/vulnerability/288d419a-9e27-45ae-bde1-1aef52532354/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00282
epssPercentile: 0.20581
ingestedAt: '2026-10-11T08:44:24.712Z'
product: Post Snippets
affected:
  - post_snippets <= 4.2.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-11T11:31:43.544442Z'
---

## Overview

The Post Snippets  WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.