# CVE-2026-77871: Post Snippets WordPress plugin stored XSS in shortcode attributes

Source: https://junglewise.ai/threats/cve-2026-77871-the-post-snippets-custom-wordpress-code-snippets-customizer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-77871 · Severity: medium · CVSS 6.4 · Published 2026-10-28

The Post Snippets plugin for WordPress allows authenticated contributors and above to inject malicious scripts into web pages via shortcode attributes. When a page with an injected shortcode is viewed by site visitors, the malicious script executes in their browsers, potentially stealing credentials, session tokens, or performing actions on their behalf. This vulnerability requires snippet shortcodes to be enabled on the site.

Vendors: [Post Snippets](https://junglewise.ai/threats/vendors/post-snippets).

## Quick answers

**Is CVE-2026-77871 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77871 being exploited in the wild.

**How severe is CVE-2026-77871?** Medium severity, with a CVSS score of 6.4, published 28 October 2026.

**Which products and versions are affected?** Post Snippets – Custom WordPress Code Snippets Customizer up to and including 4.2.4.

**Is there a fix for CVE-2026-77871?** No fixed version is recorded yet. Disable snippet shortcodes if they are not actively used. Restrict contributor-level and above access to only trusted users who do not need shortcode editing capabilities. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-77871 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77871?** Check whether you run Post Snippets – Custom WordPress Code Snippets Customizer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable snippet shortcodes if they are not actively used. Restrict contributor-level and above access to only trusted users who do not need shortcode editing capabilities.

## Technical details

Stored cross-site scripting (XSS) vulnerability in the shortcode handler due to insufficient input sanitization and output escaping. Entity-encoded payloads bypass WordPress's wp_kses_post sanitization on save because HTML entities are not decoded at that stage, but the plugin's own shortcode filter converts them back to executable HTML at render time. Attack requires authenticated attacker with contributor-level access or higher, and shortcode functionality to be enabled.

## Affected products

- Post Snippets Post Snippets – Custom WordPress Code Snippets Customizer up to and including 4.2.4

## Timeline

- 2026-10-28: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.3/src/PostSnippets/Shortcode.php](https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.3/src/PostSnippets/Shortcode.php)
- [https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.3/src/PostSnippets/Shortcode.php](https://plugins.trac.wordpress.org/browser/post-snippets/tags/4.2.3/src/PostSnippets/Shortcode.php)