The Post Snippets – Custom WordPress Code Snippets Customizer plugin has a stored XSS flaw in its shortcode attribute handling. Unsanitized attribute values are saved and later rendered by the plugin’s shortcode filter, allowing an authenticated contributor or higher user to insert JavaScript that runs in visitors’ browsers. The vulnerability can lead to session hijacking, credential theft, or defacement of a site when a user views a page containing the malicious snippet. The weakness is an input validation issue identified by CWE‑79.

The flaw affects all WordPress installations running any Post Snippets plugin version up to and including 4.2.4. The plugin is distributed by the vendor saadiqbal and is commonly active in WordPress sites that enable custom code snippets via shortcodes. No other products or versions are listed as affected in the CNA data.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score is not available, so the publicly known exploitation probability cannot be quantified at this time. The vulnerability is not yet included in the CISA KEV catalog. Because the exploit requires only authenticated contributor‑level access and relies on the plugin’s shortcodes, an attacker with legitimate contributor permissions can easily create a malicious snippet without further privilege escalation. Sites that have the plugin installed and allow contributors to edit or create snippets should prioritize remediation.