The Grid
Monthly
Privilege escalation in The Grid WordPress plugin (versions ≤ 2.7.9.1) permits any authenticated subscriber-level user to elevate their role, effectively granting unauthorized administrative access to the WordPress installation. The vulnerability stems from incorrect privilege assignment (CWE-266), where the plugin fails to properly restrict privileged actions to appropriate roles. With a CVSS score of 8.8 and no special configuration required beyond plugin installation and a valid subscriber account, this represents a meaningful threat to WordPress sites with open user registration. No public exploit code or CISA KEV listing has been identified at time of analysis.
The Grid WordPress plugin versions prior to 2.8.0 contain a missing authorization vulnerability (CWE-862) that allows attackers to exploit incorrectly configured access control security levels. This broken access control flaw enables unauthorized users to bypass authentication mechanisms and access functionality or data they should not have permission to reach. While no CVSS score or EPSS data is currently available, the vulnerability has been documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15563, indicating active tracking by vulnerability databases.
A Stored Cross-Site Scripting (XSS) vulnerability exists in Theme-one's The Grid WordPress plugin versions prior to 2.8.0, allowing attackers to inject and persist malicious scripts that execute in the browsers of other users viewing affected pages. An authenticated or unauthenticated attacker can exploit improper input neutralization during web page generation to inject arbitrary JavaScript code. While no CVSS score, EPSS probability, or KEV status has been assigned, the vulnerability is confirmed by Patchstack and carries significant risk given the stored nature of the XSS and the plugin's widespread WordPress ecosystem adoption.
Privilege escalation in The Grid WordPress plugin (versions ≤ 2.7.9.1) permits any authenticated subscriber-level user to elevate their role, effectively granting unauthorized administrative access to the WordPress installation. The vulnerability stems from incorrect privilege assignment (CWE-266), where the plugin fails to properly restrict privileged actions to appropriate roles. With a CVSS score of 8.8 and no special configuration required beyond plugin installation and a valid subscriber account, this represents a meaningful threat to WordPress sites with open user registration. No public exploit code or CISA KEV listing has been identified at time of analysis.
The Grid WordPress plugin versions prior to 2.8.0 contain a missing authorization vulnerability (CWE-862) that allows attackers to exploit incorrectly configured access control security levels. This broken access control flaw enables unauthorized users to bypass authentication mechanisms and access functionality or data they should not have permission to reach. While no CVSS score or EPSS data is currently available, the vulnerability has been documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15563, indicating active tracking by vulnerability databases.
A Stored Cross-Site Scripting (XSS) vulnerability exists in Theme-one's The Grid WordPress plugin versions prior to 2.8.0, allowing attackers to inject and persist malicious scripts that execute in the browsers of other users viewing affected pages. An authenticated or unauthenticated attacker can exploit improper input neutralization during web page generation to inject arbitrary JavaScript code. While no CVSS score, EPSS probability, or KEV status has been assigned, the vulnerability is confirmed by Patchstack and carries significant risk given the stored nature of the XSS and the plugin's widespread WordPress ecosystem adoption.