Known vulnerabilities in Code Snippets

An easy, clean, and simple way to enhance your site with code snippets.

7Reported vulnerabilities

8.8Highest CVSS score

3.9.6Latest version

1,000,000+Active installs

What to do now

Update Code Snippets to 3.9.5 or later. 7 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 12, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2020-8417	High 8.8	11.9%	Before 2.14.0	`2.14.0`	January 28, 2020
CVE-2021-25008	Medium 6.1	2.3%	Before 2.14.3	`2.14.3`	January 24, 2022
CVE-2025-13035	High 8	0.4%	0 to 3.9.1 (inclusive)	`3.9.2`	November 19, 2025
CVE-2022-25617	Medium 6.1	0.8%	2.14.3 and earlier	`2.14.4`	May 18, 2022
WF-fd0c3965-6b35-46a8-8cf0-6726cdb03c8f	Medium 6.1	—	Before 2.7.0	`2.7.0`	July 24, 2016
CVE-2023-47666	Medium 5.4	0.3%	Before 3.6.0	`3.6.0`	November 6, 2023
CVE-2026-1785	Medium 4.3	0.2%	0 to 3.9.4 (inclusive)	`3.9.5`	February 6, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.