Stored Cross-Site Scripting Vulnerability in Post Grid Gutenberg Blocks Plugin for WordPress
CVE-2026-96840

7.2HIGH

Key Information:

Vendor

WordPress
Status
Post Grid Gutenberg Blocks – Postx
Vendor
CVE Published:
10 October 2026

What is CVE-2026-96840?

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input validation and output sanitization of the display_name User Field. This vulnerability affects all versions up to and including 5.1.0. Attackers with Subscriber-level access can exploit this weakness by injecting arbitrary scripts through the display_name field located at /wp-admin/profile.php. As a result, any page showcasing the user's profile can execute the injected scripts when accessed by other users, posing significant risks to site security and user data integrity.

Affected Version(s)

Post Grid Gutenberg Blocks – PostX 0 <= 5.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/ultimate-post/...
https://plugins.trac.wordpress.org/browser/ultimate-post/...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dzaku
.