Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.10 - Reflected Cross-Site Scripting via 'order' and 'orderby' Parameters
- ID
- WPSEC-2026-2789
- Plugin
- Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts (insert-php)
- Affected
- from 2.7.0 before 2.7.11
- Remediation
- Update to 2.7.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-10
- Attack surface
- Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts on WPSec AttackSurface
- Fix released
- Published
Description
The Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order' and 'orderby' parameters on the Snippets Library page in all versions up to, and including, 2.7.10, due to insufficient output escaping. The values are only passed through sanitize_text_field(), which does not remove double quotes, and are echoed into the value attributes of hidden form inputs in the snippets list table. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a logged-in administrator into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-2789/
- https://plugins.svn.wordpress.org/insert-php/tags/2.7.11/
- https://wordpress.org/plugins/insert-php/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS