// src/PostSnippets/Shortcode.php:35
    public static function evaluateSnippet($snippet, $atts = array(), $content = null){

        if( !empty($snippet) ){

            $default_atts = self::filterVars( $snippet['snippet_vars'] );

            $texturize = $snippet["snippet_wptexturize"]?? false;

            $short_atts = shortcode_atts( $default_atts, $atts );

            $snippet_content =  $snippet['snippet_content'];

            if ( $content != null ) {
                $short_atts["content"] = $content;
            }
            foreach ($short_atts as $key => $val) {
                $snippet_content = str_replace( "{" . $key . "}", $val, $snippet_content );
            }

            // ... (omitted lines)

            // Handle PHP shortcodes
            if ( $snippet['snippet_php'] == 1 ) {
                $snippet_content = self::phpEval( $snippet_content );

---

// src/PostSnippets/Shortcode.php:98
    public static function phpEval($content)
    {
        if (defined('POST_SNIPPETS_DISABLE_PHP')) {
            return $content;
        }

        $content = stripslashes($content);

        /**Removing Initial PHP Tag */
        $content = ltrim($content, "<?php<?PHP<?=");
        
        ob_start();
        eval($content);
        $content = ob_get_clean();

        return addslashes($content);
    }

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/post-snippets/4.0.12/post-snippets.php /home/deploy/wp-safety.org/data/plugin-versions/post-snippets/4.0.13/post-snippets.php
--- /home/deploy/wp-safety.org/data/plugin-versions/post-snippets/4.0.12/post-snippets.php	2026-01-08 10:43:18.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/post-snippets/4.0.13/post-snippets.php	2026-02-02 05:06:46.000000000 +0000
@@ -11,7 +11,7 @@
  * Plugin Name: Post Snippets (free)
  * Plugin URI: https://www.postsnippets.com
  * Description: Create a library of reusable content and insert it into your posts and pages. Navigate to "Settings > Post Snippets" to get started.
- * Version: 4.0.12
+ * Version: 4.0.13
  * Author: Postsnippets
  * Author URI: https://www.postsnippets.com
  * License: GPL-2.0+
@@ -133,7 +133,7 @@
         define( 'PS_MAIN_FILE', basename( __FILE__ ) );
     }
     if ( !defined( 'PS_VERSION' ) ) {
-        define( 'PS_VERSION', '4.0.12' );
+        define( 'PS_VERSION', '4.0.13' );
     }
     if ( !defined( 'PS_MAIN_FILE_PATH' ) ) {
         define( 'PS_MAIN_FILE_PATH', __FILE__ );
@@ -298,14 +298,51 @@
             $default_atts = \PostSnippets\Shortcode::filterVars( $snippet['snippet_vars'] );
             $short_atts = shortcode_atts( $default_atts, $variables );
 
+            // Check if PHP execution is enabled for this snippet
+            $is_php_snippet = ( isset($snippet['snippet_php']) && $snippet['snippet_php'] == 1 );
+
+            // Security check: For PHP snippets, verify user has admin privileges BEFORE processing
+            if ( $is_php_snippet && !current_user_can( 'manage_options' ) ) {
+                return '<p><strong>' . esc_html__( 'Error: PHP snippet execution requires administrator privileges.', 'post-snippets' ) . '</strong></p>';
+            }
+
+            $scope_variables = array();
+
+            // Prepare variables for scope injection logic
             if( !empty($short_atts) ){
                 foreach ($short_atts as $key => $val) {
                     if( !empty($val) ){
-                        $snippet_content = str_replace( "{" . $key . "}", $val, $snippet_content );
+                        if ( $is_php_snippet ) {
+                            // For PHP snippets, we DO NOT substitute the value directly.
+                            // Instead, we assign the value to a unique variable and substitute the variable NAME.
+                            // This prevents code injection because the user input is never parsed as code.
+
+                            // Generate a safe variable name based on the key
+                            // We use a prefix to ensure we don't overwrite any internal variables
+                            $safe_key = 'attr_' . preg_replace('/[^a-zA-Z0-9_]/', '_', $key);
+
+                            // Store the value in our scope array
+                            $scope_variables[$safe_key] = $val;
+
+                            // Replace {key} with $safe_key in the snippet content
+                            // e.g. echo "{name}"; becomes echo "$attr_name";
+                            $snippet_content = str_replace( "{" . $key . "}", '$' . $safe_key, $snippet_content );
+                        } else {
+                            // For non-PHP snippets, basic sanitization and standard substitution
+                            $val = sanitize_text_field( $val );
+                            $snippet_content = str_replace( "{" . $key . "}", $val, $snippet_content );
+                        }
                     }
                 }
             }
 
+            // Handle PHP shortcodes
+            if ( $is_php_snippet ) {
+                // Extract the variables into the local scope so the eval'd code can access them
+                // We pass them to phpEval now
+                $snippet_content = \PostSnippets\Shortcode::phpEval( $snippet_content, $scope_variables );
+            }
+
             return do_shortcode( $snippet_content );
         }
 
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/post-snippets/4.0.12/src/PostSnippets/Shortcode.php /home/deploy/wp-safety.org/data/plugin-versions/post-snippets/4.0.13/src/PostSnippets/Shortcode.php
--- /home/deploy/wp-safety.org/data/plugin-versions/post-snippets/4.0.12/src/PostSnippets/Shortcode.php	2022-11-24 07:29:00.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/post-snippets/4.0.13/src/PostSnippets/Shortcode.php	2026-02-02 05:06:46.000000000 +0000
@@ -40,15 +40,50 @@
                 $short_atts["content"] = $content;
             }
+            // Check if PHP execution is enabled for this snippet
+            $is_php_snippet = ($snippet['snippet_php'] == 1);
+
+            // Security check: For PHP snippets, verify user has admin privileges BEFORE processing
+            if ($is_php_snippet && !current_user_can('manage_options')) {
+                return '<p><strong>' . esc_html__('Error: PHP snippet execution requires administrator privileges.', 'post-snippets') . '</strong></p>';
+            }
+
+            $scope_variables = array();
+
+            // Prepare variables for scope injection logic
             foreach ($short_atts as $key => $val) {
-                $snippet_content = str_replace( "{" . $key . "}", $val, $snippet_content );
+                if ($is_php_snippet) {
+                    $safe_key = 'attr_' . preg_replace('/[^a-zA-Z0-9_]/', '_', $key);
+                    $scope_variables[$safe_key] = $val;
+                    $snippet_content = str_replace("{" . $key . "}", '$' . $safe_key, $snippet_content);
+                } else {
+                    $val = sanitize_text_field($val);
+                    $snippet_content = str_replace("{" . $key . "}", $val, $snippet_content);
+                }
             }
-            if ( $snippet['snippet_php'] == 1 ) {
-                $snippet_content = self::phpEval( $snippet_content );
+            if ($is_php_snippet) {
+                $snippet_content = self::phpEval($snippet_content, $scope_variables);
             }
-    public static function phpEval($content)
+    public static function phpEval($content, $vars = array())
     {
+        if (!empty($vars)) {
+            extract($vars);
+        }
+        eval ($content);
     }