Post Grid Gutenberg Blocks Postx
Monthly
Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Stored Cross-Site Scripting in the PostX WordPress plugin (all versions through 5.0.32) allows authenticated contributors to inject arbitrary JavaScript via the 'searchnoresult' block attribute of the Advanced Search Gutenberg block. The payload executes in the browser session of any Editor or Administrator who previews the affected draft or pending post, enabling a low-privileged contributor to escalate effective access to admin-level capabilities. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the precise vulnerable source lines are publicly disclosed via Wordfence and WordPress plugin repository references.
Stored Cross-Site Scripting in the Ultimate Post (PostX) WordPress plugin versions up to and including 5.0.31 allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the 'moreResultsText' attribute of the advanced-search Gutenberg block. The root cause is a sanitization gap: the render callback applies wp_kses() which strips disallowed HTML tags but does not encode special characters like double quotes in attribute context, and the unsanitized value is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(), allowing attribute boundary escape. No public exploit code has been identified at time of analysis, and no EPSS data was provided, but the contributor-level access requirement represents the primary real-world friction point for exploitation.
Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Stored Cross-Site Scripting in the PostX WordPress plugin (all versions through 5.0.32) allows authenticated contributors to inject arbitrary JavaScript via the 'searchnoresult' block attribute of the Advanced Search Gutenberg block. The payload executes in the browser session of any Editor or Administrator who previews the affected draft or pending post, enabling a low-privileged contributor to escalate effective access to admin-level capabilities. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the precise vulnerable source lines are publicly disclosed via Wordfence and WordPress plugin repository references.
Stored Cross-Site Scripting in the Ultimate Post (PostX) WordPress plugin versions up to and including 5.0.31 allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the 'moreResultsText' attribute of the advanced-search Gutenberg block. The root cause is a sanitization gap: the render callback applies wp_kses() which strips disallowed HTML tags but does not encode special characters like double quotes in attribute context, and the unsanitized value is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(), allowing attribute boundary escape. No public exploit code has been identified at time of analysis, and no EPSS data was provided, but the contributor-level access requirement represents the primary real-world friction point for exploitation.