The Post Snippits plugin for WordPress versions up to and including 1.0 contains a missing nonce check on several settings page handlers, making it vulnerable to Cross Site Request Forgery. An unauthenticated attacker can submit a forged request to the plugin’s settings, alter configuration values, or insert malicious HTML or JavaScript that is stored by the plugin. Once a site administrator follows a malicious link or clicks a crafted button, the injected script can execute in the context of the admin’s browser, allowing for defacement, credential theft, or further drive‑by attacks.

Affected systems are WordPress sites running the phy9pas Post Snippits plugin with version number 1.0 or older. The vulnerability exists across all supported platforms that host WordPress plugins but is limited to installations where the plugin is active.

The vulnerability scores a CVSS base score of 6.1, indicating moderate severity. Exploitability requires the user to be an administrator who accepts a crafted link; the attacker does not need direct access to the server, but must lure a site owner to the site. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the overall risk is moderate with limited publicly known exploitation. Nonetheless, any successful exploitation results in stored cross site scripting, which can compromise user sessions and data.