Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)
Priority MEDIUM 40CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues
Why it matters now
EPSS 0.11241 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Post Grid (Unknown): 2.1.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Post Grid | 2.1.8 to before 2.1.8 | 2.1.8 | Patch available | CNA |
- Post Grid VendorUnknown Affected 2.1.8 to before 2.1.8 Fixed in 2.1.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pickplugins:post_grid:*:*:*:*:*:wordpress:*:* | before 2.1.8 | Vulnerable | PickPlugins |
- cpe:2.3:a:pickplugins:post_grid:*:*:*:*:*:wordpress:*:* Versions before 2.1.8 Vulnerable ·PickPlugins
Remediation
- Fix · CNA Post Grid (Unknown) Fixed in 2.1.8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24488
- 2026-10-03 Alias added: GHSA-grvg-w4gv-9v46
References
More PickPlugins Post Grid vulnerabilities
- TI-2024-08948 Post Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2024-00811 Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access CVSS 3.1MEDIUM 5.4
- TI-2024-07651 Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2020-18382 PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for… CVSS 3.1HIGH 8.8
- TI-2020-18381 PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress… CVSS 3.1HIGH 8.8
- TI-2024-12450 Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor… CVSS 3.1HIGH 8.8
Sources
- CVE-2021-24488 · CVE Program
- CVE-2021-24488 · NVD
- FIRST EPSS
- GHSA-grvg-w4gv-9v46 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences