Stored Cross-Site Scripting Vulnerability in WP Ultimate Post Grid

CVE-2024-9051

Summary

The WP Ultimate Post Grid plugin for WordPress exhibits a vulnerability that allows for Stored Cross-Site Scripting (XSS). This issue stems from inadequate input sanitization and output escaping processes within the plugin’s wpupg-grid-with-filters shortcode. As a result, authenticated users with contributor-level access and higher can exploit this vulnerability to insert arbitrary web scripts into web pages. When a user accesses an affected page, these scripts will execute, potentially compromising the security of the site and its visitors.

References