Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
medium
The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...
- CVSS:
- 6.4
- Affected:
- up to 5.2.0
- Fixed in:
- 5.2.1
- Disclosed:
- Aug 15, 2026
CVE-2026-16758 on NVD →
Snippet Shortcodes [shortcode-variables] < 4.1.7
unknown
[en] The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level...
- Affected:
- up to 4.1.7
- Fixed in:
- 4.1.7
- Disclosed:
- Dec 12, 2024
CVE-2024-12018 on NVD →
Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion
medium
The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level acce...
- CVSS:
- 4.3
- Affected:
- up to 4.1.6
- Fixed in:
- 4.1.7
- Disclosed:
- Dec 11, 2024
CVE-2024-12018 on NVD →
Snippet Shortcodes [shortcode-variables] < 4.1.5
unknown
[en] The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation when adding or editing shortcodes. This makes it possible for unauthenticated attackers to modify shortcodes via a forged request...
- Affected:
- up to 4.1.5
- Fixed in:
- 4.1.5
- Disclosed:
- Jul 3, 2024
CVE-2024-4543 on NVD →
Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery
medium
The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation when adding or editing shortcodes. This makes it possible for unauthenticated attackers to modify shortcodes via a forged request gran...
- CVSS:
- 4.3
- Affected:
- up to 4.1.4
- Fixed in:
- 4.1.5
- Disclosed:
- Jul 2, 2024
CVE-2024-4543 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database