{"schema":"threatline.record/2","record":{"id":"CVE-2026-12980","aliases":[],"summary":"Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable","details":"The Post Snippets  WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.","categories":["Unclassified"],"product":"Post Snippets","vendor":"Unknown","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-12980","source_modified_at":"2026-10-11T11:42:54.023Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Post Snippets","vendor":"Unknown","versions":[{"status":"affected","versionType":"semver","version":"0","lessThanOrEqual":"4.2.4"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0029,"percentile":0.20485,"score_date":"2026-10-23"},"published_at":"2026-10-11T06:00:08.059Z","modified_at":"2026-10-11T11:42:54.023Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-12980","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-11T11:42:54.023Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12980","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://wpscan.com/vulnerability/288d419a-9e27-45ae-bde1-1aef52532354/","tags":["exploit","vdb-entry","technical-description"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-11T11:31:43.544442Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-11T11:42:54.023Z","content_hash":"498355b8eda11dd6cad4c67d1eba2fe1f930bfe256578ea9031ef343068d7146"}}