WordPress security by component

Code Snippets

Plugin description

Code Snippets is a WordPress component with 6 published CVE records in this archive. The latest tracked vulnerability was published Feb 06, 2026; the highest CVE/CNA score is 8.8.

Plugin slug: code-snippets

Latest vulnerability

CVE-2026-1785: Code Snippets: Cross-site request forgery

Code Snippets is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

PublishedFeb 06, 2026

Safe version guidanceSee mitigation notes

		Safe version
Feb 06, 2026	CVE-2026-1785 Code Snippets: Cross-site request forgery Code Snippets is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVDPending
Nov 19, 2025	CVE-2025-13035 Code Snippets: Code execution Code Snippets is affected by code execution. Exploitation requires at least contributor-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.0 NVDPending
Nov 18, 2023	CVE-2023-47666 Code Snippets: Cross-site request forgery Code Snippets is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8
May 18, 2022	CVE-2022-25617 Code Snippets: Cross-site scripting Code Snippets is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.7 NVD6.1
Jan 24, 2022	CVE-2021-25008 Code Snippets: Cross-site scripting Code Snippets is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVD6.1
Jan 28, 2020	CVE-2020-8417 Code Snippets: Cross-site request forgery Code Snippets is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE8.8 NVD8.8