Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2026-84151: The Post Grid lets contributors embed hidden code
CVE-2026-84151 · published 25 days ago
Summary
The Post Grid plugin for WordPress, versions before 7.9.5, lets users who can edit posts (contributors and higher) add web elements like frames, style tags, or input fields that are normally blocked. Those added elements can display fake pages, alter the site’s appearance, or capture visitor data, and they appear for every visitor and for admins reviewing the content. Update the plugin to version 7.9.5 or later, or limit editing rights until the update is applied.
What to do
- Update unknown the post grid to version 7.9.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | the post grid | < 7.9.5 |
Original advisory text
The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.5
Low
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published24 Sep 2026
Updated14 Oct 2026
First seen24 Sep 2026
Track software like this
Free during beta