WP Coder – Insert & Manage Code Snippets

WP Coder – Insert & Manage Code Snippets has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; all 6 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 3 of the records (50%). Other recurring categories include Cross-Site Scripting, SQL Injection.

Every one of the 6 issues recorded for WP Coder – Insert & Manage Code Snippets has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by Krzysztof Zając. WP Coder – Insert & Manage Code Snippets is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage100%
Open

0

Fixed

6

Get automatic notifications for all WP Coder – Insert & Manage Code Snippets vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2022-2388

WP Coder <= 2.5.2 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

6 records
WP Coder – Insert & Manage Code Snippets banner
Latestv4.5.1

WP Coder – Insert & Manage Code Snippets

Wow-Company

Author

Wow-Company

4.9(32)
98/100
Last Updated
2026-08-25 (19d ago)
Active Installs
10,000+
Downloads
387,629
Requires WP
5.4+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2018-02-02 (9y ago)

Tired of editing theme files to add custom scripts or styles? WP Coder lets you insert custom HTML, CSS, JavaScript, and PHP snippets directly from your dashboard — no coding in theme files required. Gain full control and flexibility over your site. Documentation | Upgrade to Pro Why WP Coder? All-in-One Code Editor: Tabbed editor for HTML, CSS, JS & PHP with CodeMirror syntax highlighting. Gutenberg Block: Insert snippets directly in the block editor with live preview and custom attribute support. Shortcode Integration: Use [wp_code id="X"] to embed snippets anywhere. Live Preview: Instantly preview HTML & CSS without reloads in both the backend and Gutenberg. Performance Ready: Minify CSS/JS, obfuscate JavaScript, and control script loading with async / defer. Ideal For Developers: Test snippets, hooks, and debug quickly. Marketers: Insert tracking pixels, analytics, and ad scripts. Designers & Bloggers: Customize layouts, styles, and enhance engagement. Key Features Insert HTML, CSS, JS, and PHP via powerful shortcodes. Smart PHP handling: run in admin, front-end, everywhere, or only where inserted. Include external libraries (Google Fonts, CDN scripts & styles). Test Mode: Preview snippets safely before going live. Import/Export snippets and settings between sites. JavaScript Obfuscation: Protect your scripts with Dean Edwards’ Packer. Customizable Interface: Hide unused editor tabs (HTML, CSS, JS, etc.) for a cleaner workflow. NAV comments: Add inline navigation markers for faster code editing. Lightweight & secure — built for performance. Included Tools: Integrations Google Tag Manager (GTM) integration with user role controls. Google Analytics, Facebook Pixel, and Pinterest Pixel integration. Google AdSense integration with the option to disable ads for selected user roles. Content & Templates Markdown Editor – Disables Gutenberg and TinyMCE, replacing them with a Markdown editor powered by CodeMirror. Developer Tools Debug Log management (enable/disable and clear log). Show Page Debug Info – Display technical info for the current request in the Admin Bar (template, query type, object, body classes). Admins only. Theme Switcher – Quickly switch between installed themes directly from the admin bar. Included Snippets: Editor & Content Disable Gutenberg Editor Remove Gutenberg Block CSS Disable Widget Blocks Enable Shortcode Execution in Widgets Enable Excerpt for Pages Open External Links in New Tabs Change “Read More” Text Admin Interface Tweaks Disable Screen Options Tab Disable Welcome Panel Duplicate Posts Disable Admin Bar Login & User Access Disable Login Page Language Switcher Disable Login by Email Disable Admin Password Reset Emails Custom Login Logo Custom Login Redirect URLs Change Redirect After Login Change Redirect After Logout Media & Embeds Enable SVG Upload Force Lowercase Filenames Default ALT Text for Avatars Enable/Disable Lazy Load Disable Embeds Adjust oEmbed Max Dimensions Core Functionality Disable XML-RPC Disable REST API Disable Automatic Updates Disable Automatic Updates Emails Disable Emojis Disable Shortlinks Limit Post Revisions Comments & Feedback Disable Comments Globally Disable Comment URL Field Disable Self Pingbacks Disable Trackbacks & Pingbacks Disable HTML in Comments Limit Comment Length Cleanup & Optimization Remove WP Version Disable Attachment Pages Disable RSS Feeds Disable Built-in Search Disable wlwmanifest Link Disable Automatic Trash Emptying Redirect 404 to Homepage WP Coder simplifies your WordPress development workflow and makes customization safe, fast, and flexible! Get started today and simplify your WordPress development workflow with WP Coder! Quick Start Video Plugin Demo: Support Need help? Ask questions and get quick answers in our support center.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C