The Post Snippets plugin for WordPress up to version 4.2.4 does not properly escape variable values that are users with a Contributor role or higher to inject arbitrary JavaScript that is executed in the browsers of any visitor who opens a page containing the snippet. The stored cross‑site scripting can lead to theft of session cookies, defacement, or the execution of malicious actions on behalf of the site’s users.

All WordPress sites running the Post Snippets plugin version 4.2.4 or earlier are affected, regardless of the site’s theme or other plugins. The vulnerability is tied to the plugin’s snippet editing and rendering functions, so any site that uses this plugin to generate content is vulnerable.

The CVSS score of 6.8 classifies this flaw as medium severity. The EPSS score of 0.00163 indicates an extremely low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw remains substantial from a practical standpoint because it only requires a logged‑in Contributor or higher user and no additional privileges; the exploit is straightforward and does not need external network access. An attacker who can access the snippet editor can embed malicious code that will then run in the context of all visitors to pages using the snippet. The lack of a public exploit or known wide‑scale attacks suggests the probability of exploitation is very low, but the impact remains significant should an attacker leverage the vulnerability.