Vulnerabilities and security researches forcode-snippets code-snippets

Direction: ascending

Jun 06, 2024

Code Snippets # CVE-2023-47666

CVE, Research URL: CVE-2023-47666
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Nov 19, 2023
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Code Snippets Pro Code Snippets.This issue affects Code Snippets: from n/a through 3.5.0.
Affected versions: max 3.6.0.
Status: vulnerable

Code Snippets # CVE-2021-25008

CVE, Research URL: CVE-2021-25008
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Jan 24, 2022
Research Description: The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue
Affected versions: max 2.14.3.
Status: vulnerable

Code Snippets # CVE-2020-8417

CVE, Research URL: CVE-2020-8417
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Jan 29, 2020
Research Description: The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
Affected versions: max 2.14.0.
Status: vulnerable

Code Snippets # CVE-2022-25617

CVE, Research URL: CVE-2022-25617
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: May 18, 2022
Research Description: Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.
Affected versions: max 2.14.4.
Status: vulnerable

Jan 09, 2026

Code Snippets # CVE-2025-13035

CVE, Research URL: CVE-2025-13035
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Nov 19, 2025
Research Description: The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin's use of extract() on attacker-controlled shortcode attributes within the `evaluate_shortcode_from_flat_file` method, which can be used to overwrite the `$filepath` variable and subsequently passed to require_once. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server via the `[code_snippet]` shortcode using PHP filter chains granted they can trick an administrator into enabling the "Enable file-based execution" setting and creating at least one active Content snippet.
Affected versions: max 3.9.2.
Status: vulnerable

Feb 09, 2026

Code Snippets # PSC-2026-64607

PSC, Research URL: PSC-2026-64607
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Feb 09, 2026
Research Description: Code Snippets (v3.9.5) is one of the most practical productivity plugins in the WordPress ecosystem because it lets site owners add and manage custom functionality as “mini-plugins” without touching functions.php – and now it also comes with verified trust: it has earned CleanTalk’s Plugin Security Certification (PSC-2026-64607), confirming that its codebase and security boundaries hold up under real-world scrutiny, even though it operates in a category (code execution / site customization) where security discipline matters more than anywhere else.
Affected versions: Min 4.0.0, max 4.0.0.
Status: SAFE & CERTIFIED

Apr 15, 2026

Code Snippets # CVE-2026-1785

CVE, Research URL: CVE-2026-1785
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Feb 06, 2026
Research Description: The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the Cloud_Search_List_Table class. This makes it possible for unauthenticated attackers to force logged-in administrators to download or update cloud snippets without their consent via a crafted request, granted they can trick an administrator into visiting a malicious page.
Affected versions: max 3.9.5.
Status: vulnerable

Jun 16, 2026

Code Snippets # 0d4ef02dabd8c89a463ebb5a18d9fa1c4b836ebe

CVE, Research URL: 0d4ef02dabd8c89a463ebb5a18d9fa1c4b836ebe
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Nov 06, 2023
Research Description: Code Snippets [code-snippets] < 3.6.0 Code Snippets <= 3.5.0 - Cross-Site Request Forgery via load The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.5.0. This is due to missing or incorrect nonce validation on the load function. This makes it possible for unauthenticated attackers to reset plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 3.6.0.
Status: vulnerable

Code Snippets # 9f9548e1a04bfd80882b74fe9baeba815447c875

CVE, Research URL: 9f9548e1a04bfd80882b74fe9baeba815447c875
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Jul 24, 2016
Research Description: Code Snippets [code-snippets] < 2.7.0 WordPress Code Snippets Plugin <= 2.6.1 - Cross Site Scripting Because of this vulnerability, attacker can inject malicious JavaScript code into the application. Update the plugin.
Affected versions: max 2.7.0.
Status: vulnerable

Code Snippets # a7ebb9e7-4243-4531-9f05-2475a164d74b

CVE, Research URL: a7ebb9e7-4243-4531-9f05-2475a164d74b
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: -
Research Description: Code Snippets [code-snippets] < 2.7.0 Code Snippets <= 2.6.1 - Authenticated Reflected Cross-Site Scripting (XSS) The Code Snippets WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting (XSS) security vulnerability.
Affected versions: max 2.7.0.
Status: vulnerable

Code Snippets # ee237115758ba9ea48f9dd6dd1191467609e60f6

CVE, Research URL: ee237115758ba9ea48f9dd6dd1191467609e60f6
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Jul 24, 2016
Research Description: Code Snippets [code-snippets] < 2.7.0 Code Snippets < 2.7.0 - Reflected Cross-Site Scripting The Code Snippets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tag’ parameter in versions before 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 2.7.0.
Status: vulnerable

Oct 10, 2026

Code Snippets # CVE-2026-106095

CVE, Research URL: CVE-2026-106095
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Oct 09, 2026
Research Description: The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.
Affected versions: max 3.10.0.
Status: vulnerable

Code Snippets # CVE-2026-106097

CVE, Research URL: CVE-2026-106097
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Oct 09, 2026
Research Description: The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.
Affected versions: max 3.10.0.
Status: vulnerable

Nov 13, 2026

Code Snippets # CVE-2026-106468

CVE, Research URL: CVE-2026-106468
Home page URL: Security reports for Code Snippets
Application: Code Snippets
Date: Nov 11, 2026
Research Description: The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.
Affected versions: max 4.1.0.
Status: vulnerable