The Grid CVE-2026-24370

Although no CVSS score or EPSS score is published, the vulnerability's risk profile is elevated by several factors: (1) It is a Stored XSS, not Reflected XSS, meaning the malicious payload persists and affects all users viewing the compromised content, including administrators; (2) The affected product is a WordPress plugin, which typically operates with privileged access to site content and user data; (3) Patchstack's public disclosure and ENISA EUVD assignment (EUVD-2026-15565) indicate active awareness in the security community. The lack of assigned CVSS/EPSS may indicate late-stage CVE assignment or provisional scoring. Without known KEV status or public POC, the real-world exploitation rate is currently unknown, but the technical simplicity of XSS attacks and the plugin's likely user base suggest moderate-to-high actual exploitation risk. Organizations using The Grid should treat this as a high-priority patch based on the stored XSS nature and plugin prevalence.

An attacker gains low-privilege access to a WordPress site using The Grid plugin (e.g., via a compromised contributor account, weak credentials, or another vulnerability). The attacker navigates to a Grid configuration or content creation interface and injects a malicious JavaScript payload (e.g., <script>fetch('/wp-admin/user-new.php?action=createuser&user=hacker&pass=password123')</script>) into a grid cell, grid title, or metadata field that is rendered without sanitization. When administrators or site visitors view the affected grid on the frontend or backend, the injected script executes in their browsers with their privileges, potentially allowing account creation, session hijacking, or credential theft. No complex exploitation technique is required; basic JavaScript and knowledge of WordPress admin endpoints are sufficient.