Post Snippets – Custom WordPress Code Snippets Customizer

Post Snippets – Custom WordPress Code Snippets Customizer has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; 10 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 9.6 out of 10. Severity breakdown: 1 critical and 3 high. 2026 was the busiest year with 5 disclosures.

The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 5 of the records (45%). Other recurring categories include Cross-Site Request Forgery, Improper Control Of Generation Of Code.

10 of the records (91%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

9 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage91%

Open

Fixed

Get automatic notifications for all Post Snippets – Custom WordPress Code Snippets Customizer vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2026-12980

Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

11 records


2026-10-27 17:42	Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Post Snippets <= 4.2.4	`CVE-2026-77871`	6.4 Medium	Wordfence PRISM	Yes
2026-10-08 00:00	Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Post Snippets <= 4.2.4	`CVE-2026-12980`	6.4 Medium	Philipp Doblhofer	No
2026-06-25 00:00	Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.19 - Authenticated (Contributor+) Remote Code Execution Post Snippets <= 4.0.19	`CVE-2026-56049`	8.8 High	daroo	Yes
2026-05-28 13:41	Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Post Snippets <= 4.0.19	`CVE-2026-7430`	4.4 Medium	a1batr0ss	Yes
2026-03-16 00:00	Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.12 - Authenticated (Contributor+) Remote Code Execution Post Snippets <= 4.0.12	`CVE-2026-25001`	8.8 High	Doan Dinh Van (d52v)	Yes
2025-12-31 00:00	Post Snippets <= 4.0.11 - Cross-Site Request Forgery Post Snippets <= 4.0.11	`CVE-2025-63040`	4.3 Medium	Nabil Irawan	Yes
2023-07-18 00:00	Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Post Snippets 3.0.0 – 4.0.3	`CVE-2023-33999`	6.1 Medium	Rafie Muhammad	Yes
2023-05-09 00:00	Post Snippets <= 4.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'snippet_content' Post Snippets <= 4.0.2	`CVE-2023-25459`	4.4 Medium	Abdi Pranata	Yes
2022-03-04 00:00	Freemius SDK <= 2.4.2 - Missing Authorization Checks Post Snippets < 3.1.7	`CVE-2022-4974`	6.3 Medium	Anonymous	Yes
2022-01-31 00:00	Post Snippets <= 3.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting Post Snippets <= 3.1.3	`CVE-2021-25010`	9.6 Critical	Muhammad Adel	Yes

Showing 1–10 of 11 reports