Smart Post Post Grid Post Carousel Post Slider Gutenberg Blocks For Blog News
Monthly
Stored cross-site scripting in the Smart Post Gutenberg blocks plugin for WordPress affects every version through 4.0.9: an authenticated user holding only subscriber-level access can persist arbitrary script through the author 'display_name' field, which the plugin writes into its Author Filter dropdown and its client-side filter script without adequate sanitization or output escaping. The payload only fires under a narrow configuration - a page that pairs an Author Filter block with a grid or live-filter block - and only once a visitor clicks the attacker's author entry in that dropdown, which is why the assessed vector is AC:H/UI:R rather than a straight remote trigger. Impact is bounded to partial confidentiality and integrity within a changed scope (CVSS 6.4, CWE-79); there is no CISA KEV entry and no public exploit identified at time of analysis, and vuln.today slots remediation into the current-month queue rather than an emergency response.
Stored cross-site scripting in the Smart Post Gutenberg blocks plugin for WordPress affects every version through 4.0.9: an authenticated user holding only subscriber-level access can persist arbitrary script through the author 'display_name' field, which the plugin writes into its Author Filter dropdown and its client-side filter script without adequate sanitization or output escaping. The payload only fires under a narrow configuration - a page that pairs an Author Filter block with a grid or live-filter block - and only once a visitor clicks the attacker's author entry in that dropdown, which is why the assessed vector is AC:H/UI:R rather than a straight remote trigger. Impact is bounded to partial confidentiality and integrity within a changed scope (CVSS 6.4, CWE-79); there is no CISA KEV entry and no public exploit identified at time of analysis, and vuln.today slots remediation into the current-month queue rather than an emergency response.