CVE-2026-56049: Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.19 Authenticated (Contributor+) Remote Code Execution PoC, Patch Analysis & Rule

--- a/post-snippets/post-snippets.php
+++ b/post-snippets/post-snippets.php
@@ -11,7 +11,7 @@
  * Plugin Name: Post Snippets (free)
  * Plugin URI: https://www.postsnippets.com
  * Description: Create a library of reusable content and insert it into your posts and pages. Navigate to "Settings > Post Snippets" to get started.
- * Version: 4.0.19
+ * Version: 4.1.0
  * Author: Postsnippets
  * Author URI: https://www.postsnippets.com
  * License: GPL-2.0+
@@ -135,7 +135,7 @@
         define( 'PS_MAIN_FILE', basename( __FILE__ ) );
     }
     if ( !defined( 'PS_VERSION' ) ) {
-        define( 'PS_VERSION', '4.0.19' );
+        define( 'PS_VERSION', '4.1.0' );
     }
     if ( !defined( 'PS_MAIN_FILE_PATH' ) ) {
         define( 'PS_MAIN_FILE_PATH', __FILE__ );
--- a/post-snippets/src/PostSnippets/Edit.php
+++ b/post-snippets/src/PostSnippets/Edit.php
@@ -1678,7 +1678,7 @@
         if( !empty($vars) ){

             $string = $vars;
-            $pattern = '/([^A-Za-z,=_d])/i';   /**remove any character from vars that are not Letters, Numbers or digits or Illegal php variable name */
+            $pattern = '/([^A-Za-z,=:_d])/i';  /**remove any character from vars that are not Letters, Numbers or digits or Illegal php variable name */
             $replacement = '';
             $snippet_vars =  preg_replace($pattern, $replacement, $string);

--- a/post-snippets/src/PostSnippets/Shortcode.php
+++ b/post-snippets/src/PostSnippets/Shortcode.php
@@ -41,30 +41,38 @@

             $texturize = $snippet["snippet_wptexturize"]?? false;

+            foreach ($atts as $key => $val) {
+                if ( is_numeric($key) ) {
+                    $attribute = explode('=', $val, 2);
+
+                    if (count($attribute) < 2) {
+                        continue;
+                    }
+
+                    $keyName  = trim($attribute[0]);
+                    $keyValue = trim($attribute[1], " tnrx0B"'");
+
+                    $atts[$keyName] = $keyValue;
+                    unset($atts[$key]);
+                }
+            }
+
             $short_atts = shortcode_atts( $default_atts, $atts );

             $snippet_content =  $snippet['snippet_content'];

-            if ( $content != null ) {
-                $short_atts["content"] = $content;
+            if ( ! empty( $snippet['snippet_php'] ) && (int) $snippet['snippet_php'] === 1 ) {
+                $snippet_content = stripslashes( $snippet_content );
             }
-            foreach ( $short_atts as $key => $val ) {
-                $val = (string) $val;
-
-                if ( 'url' === strtolower( $key ) || 'href' === strtolower( $key ) || 'src' === strtolower( $key ) ) {
-                    $val = esc_url_raw( $val );
-                }
-
-                $clean_val = strtr(
-                    $val,
-                    array(
-                        '"' => '"',
-                        "'" => '&apos;',
-                    )
-                );

-                $snippet_content = str_replace( "{" . $key . "}", $clean_val, $snippet_content );
+            if ( $content != null ) {
+                $short_atts["content"] = $content;
             }
+            $snippet_content = self::replaceSnippetVariables(
+                $snippet_content,
+                $short_atts,
+                ! empty( $snippet['snippet_php'] ) && (int) $snippet['snippet_php'] === 1
+            );

             // There might be the case that a snippet contains
             // the post snippets reserved variable {content} to
@@ -110,8 +118,6 @@
             return $content;
         }

-        $content = stripslashes($content);
-
         /**Removing Initial PHP Tag */
         $content = ltrim($content, "<?php<?PHP<?=");

@@ -122,6 +128,112 @@
         return addslashes($content);
     }

+    public static function replaceSnippetVariables($snippet_content, $short_atts, $php_snippet = false)
+    {
+        foreach ( $short_atts as $key => $val ) {
+            $short_atts[ $key ] = self::sanitizeVariableValue( $key, $val, $php_snippet );
+        }
+
+        if ( $php_snippet ) {
+            return self::replacePhpVariables( $snippet_content, $short_atts );
+        }
+
+        foreach ( $short_atts as $key => $val ) {
+            $snippet_content = str_replace( '{' . $key . '}', $val, $snippet_content );
+        }
+
+        return $snippet_content;
+    }
+
+    public static function sanitizeVariableValue($key, $val, $php_snippet = false)
+    {
+        $val = (string) $val;
+
+        $colon = strpos($key, ':');
+
+        if ( $colon !== false ) {
+            $text = explode(":", $key);
+
+            switch (strtolower($text[1])) {
+                case 'url':
+                    $val = esc_url_raw( $val );
+                    break;
+                case 'text':
+                    $val = esc_html( $val );
+                    break;
+                case 'attr':
+                    $val = esc_attr( $val );
+                    break;
+                case 'xml':
+                    $val = esc_xml( $val );
+                    break;
+                case 'textarea':
+                    $val = esc_textarea( $val );
+                    break;
+            }
+        }
+
+        if ( $php_snippet ) {
+            return $val;
+        }
+
+        return strtr(
+            $val,
+            array(
+                '"' => '"',
+                "'" => '&apos;',
+            )
+        );
+    }
+
+    public static function replacePhpVariables($snippet_content, $short_atts)
+    {
+        $string_pattern = '/'(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*"/s';
+
+        $snippet_content = preg_replace_callback(
+            $string_pattern,
+            function ( $matches ) use ( $short_atts ) {
+                $literal = $matches[0];
+                $quote = $literal[0];
+                $body = substr( $literal, 1, -1 );
+
+                foreach ( $short_atts as $key => $val ) {
+                    $body = str_replace(
+                        '{' . $key . '}',
+                        self::escapePhpStringLiteralValue( $val, $quote ),
+                        $body
+                    );
+                }
+
+                return $quote . $body . $quote;
+            },
+            $snippet_content
+        );
+
+        foreach ( $short_atts as $key => $val ) {
+            $snippet_content = str_replace( '{' . $key . '}', var_export( $val, true ), $snippet_content );
+        }
+
+        return $snippet_content;
+    }
+
+    public static function escapePhpStringLiteralValue($val, $quote)
+    {
+        if ( $quote === '"' ) {
+            return str_replace(
+                array( '\', '"', '$' ),
+                array( '\\', '\"', '\$' ),
+                $val
+            );
+        }
+
+        return str_replace(
+            array( '\', "'" ),
+            array( '\\', "\'" ),
+            $val
+        );
+    }
+
     /**
      * Filters Snippet Variables
      * of Undesired Text.
--- a/post-snippets/src/PostSnippets/WPEditor.php
+++ b/post-snippets/src/PostSnippets/WPEditor.php
@@ -11,6 +11,20 @@
 {
     const TINYMCE_PLUGIN_NAME = 'post_snippets';

+    /**
+     * Encode a snippet value so it is safe to embed in an inline script.
+     *
+     * @param string $value Snippet content or shortcode.
+     * @return string JSON string literal.
+     */
+    private function encodeSnippetForInlineScript($value)
+    {
+        return wp_json_encode(
+            (string) $value,
+            JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT
+        );
+    }
+
     public function __construct()
     {
         // TinyMCE button must not appear in description editor of ps code, css and js edit pages.
@@ -204,21 +218,13 @@
                         }
                     }
 				    $shortcode = $snippet['snippet_title'] . $variables;
-				    array_push( $snippetStack, "var postsnippet_{$key} = '[" . $shortcode . "]';n" );
+                    array_push( $snippetStack, "var postsnippet_{$key} = " . $this->encodeSnippetForInlineScript( '[' . $shortcode . ']' ) . ";n" );
 			    } else if(isset($snippet['snippet_content'])) {
 				    // To use $snippet is probably not a good naming convention here.
 				    // rename to js_snippet or something?
-				    $snippet = $snippet['snippet_content'];
-				    # Fixes for potential collisions:
-				    /* Replace <> with char codes, otherwise </script> in a snippet will break it */
-				    $snippet = str_replace( '<', 'x3C', str_replace( '>', 'x3E', $snippet ) );
-				    /* Escape " with " */
-				    // $snippet = str_replace( '"', '"', $snippet );
-                    // $snippet = htmlspecialchars( stripslashes( $snippet ) );
-				    /* Remove CR and replace LF with n to keep formatting */
-				    $snippet = str_replace( chr( 13 ), '', str_replace( chr( 10 ), 'n', $snippet ) );
+                    $snippet = $snippet['snippet_content'];
 				    # Print out the variable containing the snippet
-				    array_push( $snippetStack, "var postsnippet_{$key} = "" . $snippet . "";n" );
+                    array_push( $snippetStack, "var postsnippet_{$key} = " . $this->encodeSnippetForInlineScript( $snippet ) . ";n" );
 			    }
 		    }
 	    }