Stored Cross-Site Scripting in Smart Post Plugin for WordPress

CVE-2026-119160

What is CVE-2026-119160?

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability via the 'display_name' parameter in all versions up to and including 4.0.9. This issue arises from inadequate input sanitization and output escaping, enabling authenticated attackers with subscriber-level access or higher to inject malicious web scripts into pages. The exploitation process necessitates the presence of an Author Filter block along with a grid or live-filter block on the victim's page. The attack is initiated when a visitor clicks on the attacker's author entry in the dropdown menu, a common interaction that does not demand any privileged access from the victim.

References