{"id":"CVE-2026-12980","title":"The Post Snippets  WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute …","summary":"The Post Snippets  WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute …","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-79"],"published":"2026-10-11","updated":"2026-10-11","sourceUpdated":"2026-10-11T12:16:53.407","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12980","references":[{"url":"https://wpscan.com/vulnerability/288d419a-9e27-45ae-bde1-1aef52532354/","label":"contact@wpscan.com"}],"tags":["nvd"],"ingestedAt":"2026-10-11T08:44:24.712Z","epss":0.00163,"epssPercentile":0.05075,"slug":"CVE-2026-12980","body":"## Overview\n\nThe Post Snippets  WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":219219,"id":"CVE-2026-12980","ts":1791723023694,"field":"cvss","old":null,"new":"6.8"},{"seq":219218,"id":"CVE-2026-12980","ts":1791723023694,"field":"severity","old":"none","new":"medium"}]}