The Post Grid EUVD-2026-85485

Requires an authenticated WordPress account with at least Contributor privileges (PR:L) on a site running The Post Grid plugin version 7.9.5 or earlier. Exploitation is stored/persistent XSS that further depends on user interaction (UI:R): a higher-privileged user such as an administrator or editor must subsequently view the attacker-supplied content in the admin dashboard for the payload to fire. Limiting factors: sites that do not grant Contributor (or higher) roles to untrusted users are not exposed, and no unauthenticated path exists. No fixed version is identified in the provided data; upgrade beyond 7.9.5 when a patched release is confirmed by RadiusTheme/Patchstack.

This is a genuine but modest-priority issue - a high-CVSS-relative-to-real-risk case tempered by strong preconditions. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L = 6.5 Medium) requires an authenticated Contributor account (PR:L) plus victim interaction (UI:R), which sharply narrows the attacker population versus an unauthenticated flaw. The scope change (S:C) reflects the standard stored-XSS pattern where a low-privileged Contributor plants a payload that later executes in a higher-privileged admin/editor's authenticated browser session, potentially enabling privilege escalation or account takeover via session/cookie theft. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis.' I question the A:L (availability) impact assigned by the reporter - XSS realistically yields confidentiality/integrity effects, not availability, so a vector ending A:N (~6.4) is more defensible. Net: a real defense-in-depth fix for sites that grant untrusted users Contributor roles, but not an emergency; low realistic risk on sites with a trusted, small author base.

An attacker with (or who registers/obtains) a Contributor account on a WordPress site running The Post Grid <= 7.9.5 injects a malicious JavaScript payload into a plugin-controlled field that is not properly sanitized/escaped. When an administrator or editor later views that content in wp-admin, the script executes in their authenticated session, allowing cookie/session theft or admin-context actions. No public proof-of-concept is reported; exploitation requires the victim admin to view the attacker-controlled content (UI:R).