Insert PHP Code Snippet Vulnerability – Authenticated (Admin+) Stored Cross-Site Scripting – CVE-2024-0658 |WordPress Plugin Vulnerability Report 

Plugin Name: Insert PHP Code Snippet

Key Information:

  • Software Type: Plugin
  • Software Slug: insert-php-code-snippet
  • Software Status: Active
  • Software Author: f1logic
  • Software Downloads: 890,439
  • Active Installs: 100,000
  • Last Updated: February 16, 2024
  • Patched Versions: 1.3.5
  • Affected Versions: <= 1.3.4

Vulnerability Details:

  • Name: Insert PHP Code Snippet <= 1.3.4
  • Title: Authenticated (Admin+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-0658
  • CVSS Score: 4.4
  • Publicly Published: February 9, 2024
  • Researcher: Felipe Restrepo Rodriguez
  • Description: The Insert PHP Code Snippet plugin is susceptible to Stored Cross-Site Scripting (XSS) attacks in versions up to and including 1.3.4. This vulnerability arises from inadequate input sanitization and output escaping, particularly when handling user names on the insert-php-code-snippet-manage page. Only authenticated users with administrative privileges can exploit this flaw, which allows the injection of arbitrary web scripts that execute when a user visits an affected page. It's noteworthy that this vulnerability primarily impacts multi-site installations or instances where the unfiltered_html capability has been disabled.


The Insert PHP Code Snippet plugin harbors a vulnerability in versions up to 1.3.4, enabling Admin-level users to execute stored XSS attacks. This issue has been resolved in version 1.3.5, ensuring enhanced security for users of this plugin.

Detailed Overview:

Identified by researcher Felipe Restrepo Rodriguez, this vulnerability puts websites at risk by allowing malicious scripts to be stored within the plugin's settings. Such scripts could be executed unknowingly by other users, leading to potential data breaches or unauthorized administrative actions. The specific nature of this vulnerability means that it is less likely to be exploited en masse, given the need for administrative access, but it underscores the importance of rigorous input validation and output encoding practices in plugin development.

Advice for Users:

  • Immediate Action: Users of the Insert PHP Code Snippet plugin should promptly update to version 1.3.5 to mitigate this vulnerability.
  • Check for Signs of Vulnerability: Administrators are advised to review their site for any unusual activities or injected scripts, particularly if administrative accounts have been compromised in the past.
  • Alternate Plugins: While the latest patch addresses this vulnerability, users may consider evaluating alternative plugins for executing PHP code snippets that adhere to stringent security standards.
  • Stay Updated: It's crucial to maintain the latest versions of all installed plugins to protect against known vulnerabilities and ensure the ongoing security of your WordPress site.


The swift action taken to rectify this vulnerability in the Insert PHP Code Snippet plugin highlights the critical nature of maintaining up-to-date software on your WordPress site. By updating to version 1.3.5 or later, users can safeguard their sites against potential XSS attacks facilitated by this flaw.


In today's digital ecosystem, the security of your WordPress website is not just a priority but a necessity. The recent discovery of a vulnerability in the widely-used "Insert PHP Code Snippet" plugin, marked as CVE-2024-0658, serves as a stark reminder of the latent risks in digital tools we often take for granted. This vulnerability exposes websites to potential Stored Cross-Site Scripting (XSS) attacks, specifically targeting websites with multi-site installations or those where the unfiltered_html capability has been disabled. It's a wake-up call to the importance of maintaining vigilance and up-to-date practices in website security management.

About the Plugin:

"Insert PHP Code Snippet" is a popular WordPress plugin developed by f1logic, with over 890,439 downloads and 100,000 active installations. It allows users to easily execute PHP code snippets on their WordPress sites, enhancing functionality and customizability. Despite its utility, the plugin became a security concern when versions up to and including 1.3.4 were found to be vulnerable to XSS attacks due to inadequate input sanitization and output escaping.

Vulnerability Details:

The vulnerability, identified by researcher Felipe Restrepo Rodriguez and publicly disclosed on February 9, 2024, enables attackers with administrative privileges to inject malicious scripts into web pages. These scripts could potentially be executed by unsuspecting users, leading to unauthorized access, data breaches, or other malicious activities. The issue was specifically found in the handling of user names on the plugin's management page and affects all versions up to 1.3.4.

Risks and Potential Impacts:

The primary risk of this vulnerability is the unauthorized execution of web scripts, which could compromise user data and website integrity. For businesses, this could mean a loss of customer trust, damage to reputation, or even legal consequences, especially if sensitive customer information is compromised. The targeted nature of this vulnerability means that the risk is somewhat mitigated by the requirement for administrative access, but it nonetheless underscores the importance of strict role management and security practices.

Remediation and Previous Vulnerabilities:

To address this vulnerability, the plugin developers released version 1.3.5, which includes necessary patches. Users are urged to update their plugin to this latest version immediately. It's also advisable to review administrative access and monitor for any unusual activities or injected scripts. This isn't the first time vulnerabilities have been discovered in WordPress plugins, highlighting the ongoing battle against security threats in the digital space.


For small business owners juggling numerous responsibilities, staying on top of security updates might seem daunting. However, the security of your WordPress site is crucial for protecting your business and customer data. Implementing regular update checks, utilizing security plugins, and following best practices for user access management can significantly mitigate risks. Remember, in the realm of cybersecurity, complacency can be the biggest vulnerability. The recent "Insert PHP Code Snippet" vulnerability is a reminder of the ever-present need for vigilance and proactive security measures in safeguarding your digital presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Insert PHP Code Snippet Vulnerability – Authenticated (Admin+) Stored Cross-Site Scripting – CVE-2024-0658 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment