The Post Grid EUVD-2026-85483

Exploitation requires an authenticated WordPress account with at least Contributor privileges (PR:L) on a site running The Post Grid plugin version 7.9.5 or earlier, plus subsequent interaction by a higher-privileged user (UI:R) - typically an administrator or editor viewing the attacker-submitted content in wp-admin, which is when the stored payload executes. Limiting factors: the attacker cannot exploit anonymously (rules out drive-by mass exploitation), the payload only achieves impact when a privileged user renders it, and the impact is scoped to script execution in the victim's browser (Low C/I) rather than direct server compromise. Sites that disable open user registration or restrict Contributor content review significantly reduce exposure.

This is a moderate-severity, low-real-world-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes an authenticated (PR:L) stored XSS requiring victim interaction (UI:R) with only Low confidentiality and integrity impact. Two exploitation signals materially cap risk: PR:L means the attacker must already hold at least a Contributor account on the target WordPress site (a semi-trusted, self-registerable-in-some-configs role), and UI:R means a higher-privileged user (typically an admin/editor) must view the malicious content for the payload to fire. There is NO EPSS score, NO CISA KEV listing, and NO public POC referenced in the provided intelligence - the sole source is the Patchstack database entry. The A:L (availability) rating is questionable for a reflected-in-admin XSS; a stored XSS that runs script in an admin browser typically maps cleanly to C:L/I:L with A:N, so a more defensible score is ~6.4. Bottom line: real but not urgent - this is a classic Contributor-role stored XSS that matters for multi-author WordPress sites, not a mass-exploitation candidate.

An attacker holding a Contributor account (or one obtained via open registration/compromise) on a site running The Post Grid <= 7.9.5 submits a post or grid element containing a crafted XSS payload in an inadequately sanitized field. When an administrator or editor later reviews that content in wp-admin, the script executes in their authenticated session, enabling actions such as cookie/nonce theft or admin-context requests. No public exploit code is referenced in the provided data.