CVE-2021-25010: Post Snippets < 3.1.4 - CSRF to Stored Cross-Site Scripting

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-28 · updated 2026-06-17
Weakness: CWE-352

Description

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues

Affected products

Post Snippets: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: Post Snippets 3.1.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/d1ebd15a-72ab-4ba2-a212-7e2eea0b0fb0
https://wpscan.com/vulnerability/d1ebd15a-72ab-4ba2-a212-7e2eea0b0fb0

Get alerted when CVE-2021-25010 or the next vulnerability affects your stack