PLUGIN SECURITY
Is Code Snippets safe?
Manage custom WordPress code in one dashboard. Create PHP and HTML snippets, preview code, track snippet totals and reuse code across sites.
What this plugin does
- Slug:
code-snippets - Author: Code Snippets Pro
- 1000000+ active installs
- 94/100 rating (509 reviews on wordpress.org)
- 24346086 all-time downloads
- On WordPress.org since 2012-06-13
codefunctionsmultisitephpsnippets
Maintenance status
- Latest known version: 3.9.6
- Last updated: 2026-10-21 4:48pm GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
8 known CVEs on file for Code Snippets.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-106097 | Code Snippets [code-snippets] < 3.10.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 3.10.0 | 3.10.0 | 2026-10-09 | ⚠ update needed |
| CVE-2026-106095 | Code Snippets [code-snippets] < 3.10.0 | Missing Authorization | Unknown | < 3.10.0 | 3.10.0 | 2026-10-09 | ⚠ update needed |
| CVE-2025-13035 | Code Snippets [code-snippets] < 3.9.2 | Improper Control of Generation of Code ('Code Injection') | High 8.0 | < 3.9.2 | 3.9.2 | 2025-11-18 | ✓ fixed in latest |
| CVE-2023-47666 | Code Snippets [code-snippets] < 3.6.0 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.6.0 | 3.6.0 | 2023-11-06 | ✓ fixed in latest |
| CVE-2022-25617 | Code Snippets [code-snippets] < 2.14.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.14.4 | 2.14.4 | 2022-05-18 | ✓ fixed in latest |
| CVE-2021-25008 | Code Snippets [code-snippets] < 2.14.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.14.3 | 2.14.3 | 2021-12-27 | ✓ fixed in latest |
| CVE-2020-8417 | Code Snippets [code-snippets] < 2.14.0 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 2.14.0 | 2.14.0 | 2020-01-28 | ✓ fixed in latest |
| — | Code Snippets [code-snippets] < 2.7.0 | — | Unknown | < 2.7.0 | 2.7.0 | 2016-07-24 | ✓ fixed in latest |
+ 6 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Code Snippets [code-snippets] < 2.7.0 | — | Unknown | < 2.7.0 | 2.7.0 | 2016-07-24 | ✓ fixed in latest |
| — | Code Snippets [code-snippets] < 3.9.5 | — | Unknown | < 3.9.5 | 3.9.5 | 0000-00-00 | ✓ fixed in latest |
| — | Code Snippets [code-snippets] < 2.7.0 | — | Unknown | < 2.7.0 | 2.7.0 | — | ✓ fixed in latest |
| — | Code Snippets < 2.7.0 - Authenticated Reflected Cross-Site Scripting (XSS) | — | Unknown | < 2.7.0 | 2.7.0 | — | ✓ fixed in latest |
| CVE-2023-47666 | Code Snippets < 3.6.0 - Arbitrary settings change via CSRF | — | Unknown | < 3.6.0 | 3.6.0 | — | ✓ fixed in latest |
| CVE-2026-1785 | Code Snippets < 3.9.5 - Cloud Snippet Download/Update Actions via CSRF | — | Unknown | < 3.9.5 | 3.9.5 | — | ✓ fixed in latest |
How to fix it
Keep Code Snippets updated — 3.9.6 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager — 3000000+ active installs — 98/100 (1911) — max PHP 8.4
- Head & Footer Code — 100000+ active installs — 100/100 (51) — max PHP 8.4
- Simple Custom CSS Plugin — 100000+ active installs — 94/100 (159)
- Shortcoder — Create Shortcodes for Anything — 100000+ active installs — 98/100 (227)
- Scripts n Styles — 30000+ active installs — 88/100 (30)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.