- Son 7 gün
- CWE-79
CVE-2026-77871
Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer
- Yayımlandı
- Güncellendi
- 28 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- Wordfence
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Entity-encoded payloads such as <script>...</script> survive WordPress's wp_kses_post on-save sanitization because kses does not decode HTML entities, and are only converted back into executable HTML tags at render time by the plugin's own shortcode filter. This requires snippet shortcodes to be enabled.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer | ≤ 4.2.4 | – |
Kaynaklar12 kaynak
- CVE.org kaydı
- NVD kaydı
- wordfence.com/…lities/id/a46c37f4-245d-423f-bdad-296fdf377ecc Diğer
- plugins.trac.wordpress.org/…pets/tags/4.2.3/src/PostSnippets/Shortcode.php Diğer
- plugins.trac.wordpress.org/…pets/tags/4.2.4/src/PostSnippets/Shortcode.php Diğer
- plugins.trac.wordpress.org/…pets/tags/4.2.4/src/PostSnippets/Shortcode.php Diğer
- plugins.trac.wordpress.org/…pets/tags/4.2.4/src/PostSnippets/Shortcode.php Diğer
- plugins.trac.wordpress.org/…pets/tags/4.2.4/src/PostSnippets/Shortcode.php Diğer
- plugins.trac.wordpress.org/…pets/tags/4.2.3/src/PostSnippets/Shortcode.php Diğer
- plugins.trac.wordpress.org/…pets/tags/4.2.3/src/PostSnippets/Shortcode.php Diğer
- plugins.trac.wordpress.org/…pets/tags/4.2.3/src/PostSnippets/Shortcode.php Diğer
- plugins.trac.wordpress.org/…-snippets/trunk/src/PostSnippets/Shortcode.php Diğer
Kayıt geçmişi
- Yayımlandı