What is the CVSS score of CVE-2026-5158?

CVE-2026-5158 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

PostX WordPress Plugin CVE-2026-5158

EUVD-2026-53863 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Wordfence

GHSA-9p8w-4chc-chhq

WordPress XSS Wordpress Plugin Post Grid Gutenberg Blocks Postx Wpxpo

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS payload requires a victim to load the page (UI:R); contributor credentials required (PR:L); script executes across scope boundary in victim browser (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 12:25 vuln.today

CVE Published

Aug 06, 2026 - 11:29 nvd

MEDIUM 6.4

DescriptionCVE.org

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.

Technical ContextAI

PostX (plugin slug 'ultimate-post', vendor wpxpo, CPE cpe:2.3:a:wpxpo:post_grid_gutenberg_blocks_-_postx:*:*:*:*:*:*:*:*) is a WordPress Gutenberg block plugin targeting news, magazine, and blog layouts. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the 'inputPlaceHolder' parameter accepts user-supplied data that is neither sanitized on input nor properly escaped on output, allowing raw HTML and JavaScript to persist in the post database and render in visitor browsers. The Gutenberg block editor context means contributor-level authors can insert and configure PostX blocks directly within the post composition workflow, making the attack surface accessible to any authenticated user at or above the Contributor role.

RemediationAI

Update the PostX plugin to a version beyond 5.0.13 via the WordPress admin plugin update interface or WP-CLI ('wp plugin update ultimate-post'). A fix has been committed upstream as Trac changeset 3501596 (https://plugins.trac.wordpress.org/changeset/3501596/ultimate-post); however, the exact patched release version is not confirmed in the available data - verify via the WordPress plugin repository changelog before updating. As an interim compensating control, restrict Contributor-level role assignment to trusted users only, or temporarily remove the Contributor role's ability to publish content until the patch is applied - note this may impact editorial workflows. Disabling the PostX plugin entirely eliminates the attack surface but removes its page-building functionality.