Cross‑Site Request Forgery in the Snippy WordPress plugin allows a user to submit a request that the plugin accepts without validating a CSRF token. The vulnerability can result in reflected XSS, where arbitrary JavaScript is rendered in the victim’s browser. The CVE description does not specify a particular HTTP endpoint, but it indicates that the absence of CSRF protection for plugin requests permits arbitrary payloads to be reflected back. The injected script runs with the privileges of the victim’s session, potentially hijacking cookies or defacing the site.

All WordPress sites that use the Snippy plugin from any unreleased build up to and including version 1.4.1 are affected. No specific WordPress core or operating‑system version is mentioned in the CVE data, so any installation of the vulnerable plugin range is at risk.

The CVSS base score of 7.1 signifies a high severity issue. The EPSS score of less than 1% indicates that real‑world exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog. Attackers would need to craft a request that bypasses CSRF checks, a scenario that is inferred from the description; the resulting reflected XSS could compromise confidentiality and integrity for users, especially administrators who could gain elevated access or deface the site.