The Post Grid EUVD-2026-85800

Requires an authenticated account with at least the WordPress Contributor role on a site running The Post Grid before 7.9.5; the flaw exists because the plugin expands the WordPress allowed-HTML (kses) list beyond its own shortcodes and applies it site-wide to all post content. Exploitation is limited by: (1) the attacker needing a Contributor-or-higher account (the CVSS vector states PR:H, though the description implies the lower Contributor tier suffices); (2) required user interaction (UI:R) - a visitor or reviewing administrator must load the page for the stored markup to render; and (3) the impact ceiling being HTML injection only - iframe/style/input elements, not script execution - so outcomes are phishing/defacement/form-spoofing rather than code execution.

This is a low-to-moderate severity stored HTML-injection issue, not a critical priority. WPScan/NVD score it CVSS 3.1 3.5 (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N), and every corroborating signal points to constrained real-world risk: SSVC returns Exploitation=none, Automatable=no, Technical Impact=partial; there is no EPSS score and no CISA KEV listing. Public exploit code exists (WPScan), but that is proof-of-concept availability, not evidence of active exploitation. One notable conflict: the CVSS vector uses PR:H, yet the description states the flaw is reachable by 'Contributor role and above' - Contributor is a low-privilege authenticated role, which normally maps to PR:L, so the vendor's PR:H appears to understate reachability (more roles qualify than PR:H implies). Additionally, because the injected markup renders to unrelated site visitors and to administrators reviewing content, a scope change (S:C) is arguable rather than the S:U the vendor chose. The impact ceiling is genuinely limited: only iframe/style/input elements are permitted (script tags remain stripped), so this enables phishing frames, CSS defacement and spoofed input forms - HTML injection - rather than full JavaScript execution. Net: a real but modest issue best treated as a routine patch, weighted up slightly because it lowers the bar to a widely-held authenticated role.

An attacker who has (or registers/obtains) a Contributor account on a WordPress site running The Post Grid submits a post containing iframe, style, or input markup that the plugin's site-wide expansion of the allowed-HTML list no longer strips. When any visitor - or an administrator reviewing the pending post - loads the content, the injected iframe/form renders, enabling a convincing phishing overlay or credential-harvesting form. Public PoC detail is available via WPScan, and no user interaction beyond simply viewing the page is required.