The Post Snippets plugin allows a malicious import file to embed JavaScript code directly into the post editor when the import feature is used. Because the plugin fails to properly escape double quotes in the snippet content, the payload can break out of its JavaScript string context and execute in the browser of any administrator who opens the editor. This represents a stored cross‑site scripting flaw (CWE‑79).

All installations of the Post Snippets plugin with versions 4.0.19 and earlier are affected. The vendor is saadiqbal:Post Snippets – Custom WordPress Code Snippets Customizer. WordPress single‑site administrators are not impacted because they already possess the unfiltered_html capability, which mitigates the issue in that context.

The CVSS score of 4.4 indicates moderate severity, and while the EPSS score is not available, the flaw requires an authenticated administrator and is not listed in the CISA KEV catalog. An attacker can upload a crafted import file from an account with Administrator privileges or higher and then rely on any subsequent access to the post editor by an administrator to trigger the embedded script. The risk is therefore moderate to high within environments where administrators perform regular editor use.