Reflected Cross-Site Scripting in Post Grid Master Plugin for WordPress
CVE-2025-5084
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 July 2025
What is CVE-2025-5084?
The Post Grid Master plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to improper input sanitization and output escaping in the ‘argsArray['read_more_text']’ parameter. This flaw allows unauthenticated attackers to execute arbitrary web scripts on the pages, targeting unsuspecting users who are deceived into clicking a malicious link. All versions up to and including 3.4.13 are affected, making it crucial for site administrators to patch this vulnerability to protect their users and maintain security.
Affected Version(s)
Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder * <= 3.4.13