CVE-2021-25010

PoC —

CVSS 3.1

9.6 critical

EPSS

<1%p47

Published

Feb 28, 2022 (Feb 28, 2022)

Modified

Jun 17, 2026

Description

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues

Vendors: postsnippets
Products: post snippets
Ecosystems: WordPress
Weakness: CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.