CVE-2026-7430— Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| saadiqbal | Post Snippets – Custom WordPress Code Snippets Customizer | ≤ 4.0.19 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7430
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Post Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.0.19. This is due to insufficient output escaping of imported snippet content when rendering JavaScript variables in the post editor. Specifically, the `jqueryUiDialog()` method in `WPEditor.php` embeds snippet content directly into JavaScript string literals without escaping double quotes (the quote-escaping code on line 214 is commented out). When snippets are imported via the Import/Export feature, the content bypasses WordPress's `wp_magic_quotes()` (which would otherwise add protective backslashes), allowing double quotes in snippet content to break out of the JavaScript string context. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via a malicious import file that execute whenever any administrator accesses a post editor page. Please note that this does not affect single-site installations as administrators already have the `unfiltered_html` capability.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| saadiqbal | Post Snippets – Custom WordPress Code Snippets Customizer | 0 ~ 4.0.19 | - |
II. Public POCs for CVE-2026-7430
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7430
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-7430 (4)
Vendor Advisories for CVE-2026-7430 (1)
IV. Related Vulnerabilities
Same vendor: saadiqbal
- CVE-2026-3090
Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-2559
Post SMTP <= 3.8.0 - Missing Authorization to Authenticated - CVE-2026-1674
Gutena Forms – Contact Form, Survey Form, Feedback Form, Boo - CVE-2026-0550
myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cros - CVE-2026-0832
New User Approve <= 3.2.2 - Missing Authorization to Unauthe
Same weakness: CWE-79
- CVE-2026-10173
Orthanc Explorer 2 URL StudyList.vue cross site scripting - CVE-2026-10153
westboy CicadasCMS AbstractCacheManager.java search cross si - CVE-2026-10112
sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scr - CVE-2026-34127
Stored Cross-Site Scripting (XSS) via Configuration File Imp - CVE-2026-49384
PyCharm < 2025.3.4 Jupyter笔记存储型XSS漏洞
V. Comments for CVE-2026-7430
No comments yet