Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2021-24986: The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post ...
CVE-2021-24986 · published 4 years ago
Summary
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form
What to do
- Update pickplugins post_grid to version 2.1.16 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pickplugins | post_grid |
< 2.1.16 cpe:2.3:a:pickplugins:post_grid:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post ...
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form
References
- https://wpscan.com/vulnerability/51e57f25-b8b2-44ca-9162-d7328eac64eb Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Apr 2022
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2021-24986 · NVD
Track software like this
Free during beta