# Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.10 - Reflected Cross-Site Scripting via 'order' and 'orderby' Parameters

- **ID:** WPSEC-2026-2789
- **Plugin:** Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts (`insert-php`), https://wordpress.org/plugins/insert-php/
- **Affected versions:** from 2.7.0 before 2.7.11
- **Fixed in:** 2.7.11 (Update to 2.7.11 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/insert-php
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2789/

## Description

The Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order' and 'orderby' parameters on the Snippets Library page in all versions up to, and including, 2.7.10, due to insufficient output escaping. The values are only passed through sanitize_text_field(), which does not remove double quotes, and are echoed into the value attributes of hidden form inputs in the snippets list table. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a logged-in administrator into performing an action such as clicking on a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-2789/
- https://plugins.svn.wordpress.org/insert-php/tags/2.7.11/
- https://wordpress.org/plugins/insert-php/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2789/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.