What is the CVSS score of CVE-2026-15100?

CVE-2026-15100 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

PostX CVE-2026-15100

EUVD-2026-48461 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-24 Wordfence

GHSA-vrqp-vqfm-w2jv

WordPress XSS Wordpress Plugin Post Grid Gutenberg Blocks Postx Wpxpo

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS execution requires a privileged user to load the injected page (UI:R); PR:L reflects mandatory contributor authentication; S:C captures cross-session privilege boundary impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:02 vuln.today

CVE Published

Jul 24, 2026 - 02:31 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Post Grid Gutenberg Blocks - PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post.

AnalysisAI

Stored Cross-Site Scripting in the PostX WordPress plugin (all versions through 5.0.32) allows authenticated contributors to inject arbitrary JavaScript via the 'searchnoresult' block attribute of the Advanced Search Gutenberg block. The payload executes in the browser session of any Editor or Administrator who previews the affected draft or pending post, enabling a low-privileged contributor to escalate effective access to admin-level capabilities. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the precise vulnerable source lines are publicly disclosed via Wordfence and WordPress plugin repository references.

Technical ContextAI

PostX (plugin slug: ultimate-post, vendor: wpxpo) is a Gutenberg block plugin for WordPress that provides post grid layouts and an Advanced Search block. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation): the 'searchnoresult' attribute accepted by the Advanced Search block is neither sanitized on input nor escaped on output before being rendered into the page DOM. The vulnerable code paths are confirmed at Advanced_Search.php lines 107 and 116 and Blocks.php line 231 in the 5.0.32 tagged release. WordPress provides native escaping helpers (esc_html(), wp_kses()) that are not applied to this attribute. The CPE cpe:2.3:a:wpxpo:post_grid_gutenberg_blocks_-_postx:*:*:*:*:*:*:*:* covers all versions through 5.0.32 as affected.

RemediationAI

An upstream fix has been committed to the WordPress plugin Subversion repository (changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3613430%40ultimate-post&new=3613430%40ultimate-post), indicating a patch is available; however, the exact patched release version number is not confirmed in the available data. Administrators should update PostX to the latest version available in the WordPress Plugin Directory immediately, as the fix should be included. As a compensating control while scheduling the update, restrict contributor-level accounts to only fully trusted users and remove contributor registration if not operationally required - this eliminates the attacker prerequisite. Additionally, block editor access restrictions using a capability management plugin (e.g., restricting the PostX Advanced Search block to Editor-level and above) can prevent untrusted contributors from inserting the vulnerable block attribute. Note that blocking contributor access to the block may affect editorial workflows if contributors legitimately use the Advanced Search functionality.