Description

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T06:16:51.090Z",
  "pubdate": "2026-08-16T06:16:51.090Z",
  "executiveSummary": "The Snippet Shortcodes plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 5.2.0. This security flaw stems from insufficient input sanitization and inadequate output escaping mechanisms applied to shortcode attributes. The vulnerability enables authenticated malicious actors possessing contributor-level access or higher to inject arbitrary web scripts into pages and posts. When a user subsequently accesses an injected page, the malicious payload executes within the context of their browser session, leading to potential session hijacking, unauthorized actions performed on behalf of the victim, or arbitrary DOM manipulation. The risk implications are significant for multi-author WordPress installations where low-privileged users, such as contributors, are permitted to draft content containing shortcodes. Successful exploitation requires authenticated access to create or edit content containing the vulnerable shortcode, coupled with user interaction as a victim views the rendered page.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper handling of shortcode attributes within the Snippet Shortcodes plugin. Specifically, the component fails to adequately sanitize user-supplied input passed through shortcode attributes prior to processing, and subsequently fails to apply context-aware output escaping when rendering the data back to the Document Object Model (DOM).\nThe vulnerable component comprises the shortcode parsing and rendering engine of the Snippet Shortcodes plugin across all versions up to and including 5.2.0. Because the application processes user-controlled shortcode attributes without enforcing strict allowlisting or proper HTML entity encoding, malicious input containing JavaScript vectors can be successfully persisted within the database.\nThe attack flow proceeds in a sequential manner. First, an authenticated attacker with contributor-level privileges or higher crafts a malicious shortcode incorporating arbitrary JavaScript payloads within one of the attribute parameters. Second, the attacker saves this payload within a WordPress post, page, or snippet. Third, when a victimized user or administrator navigates to the rendered page containing the shortcode, the plugin processes the input and outputs the unescaped payload directly into the HTML response.\nUpon rendering, the browser interprets the injected string as executable script code rather than harmless text data. The payload executes with the privileges of the victim user session, allowing the attacker to perform actions such as stealing session cookies, capturing sensitive data, or executing unauthorized administrative functions if the victim possesses elevated privileges. The exploitation vector is network-based via HTTP/HTTPS requests interacting with the WordPress platform, and requires low-privileged authentication (contributor-level access) combined with victim interaction to achieve full code execution."
}