---
id: CVE-2026-12980
title: >-
  The Post Snippets  WordPress plugin through 4.2.4 does not properly escape
  variable values substituted into snippets before outputting them, allowing
  users with the Contributor role and above to inject arbitrary web scripts that
  execute …
summary: >-
  The Post Snippets  WordPress plugin through 4.2.4 does not properly escape
  variable values substituted into snippets before outputting them, allowing
  users with the Contributor role and above to inject arbitrary web scripts that
  execute …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:16:53.407'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12980'
references:
  - url: 'https://wpscan.com/vulnerability/288d419a-9e27-45ae-bde1-1aef52532354/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.712Z'
epss: 0.00163
epssPercentile: 0.05075
---

## Overview

The Post Snippets  WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.