CVE-2021-25010: Postsnippets Post Snippets

Critical severity, CVSS 9.6. EPSS: 0.6% chance of exploitation in the next 30 days.

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues

Affected products

• Postsnippets Post Snippets: before 3.1.4 (fixed in 3.1.4)

Published 2022-02-28. Last modified 2026-06-17.