Vulnerabilities / The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid / WPSEC-2026-2015
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.7 - Unauthenticated DOM-Based Cross-Site Scripting via URL Fragment
Medium 4.7
CWE-79Fixed in 7.9.8
- ID
- WPSEC-2026-2015
- Plugin
- The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid (the-post-grid)
- Affected
- all versions before 7.9.8
- Remediation
- Update to 7.9.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid on WPSec AttackSurface
- Fix released
- Published
Description
The The Post Grid plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the URL fragment (location.hash) in all versions up to, and including, 7.9.7. The isotope 'filter in URL' handler passed the hash unchecked to the isotope filter and into a jQuery selector string. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in a victim's browser if they can trick the victim into opening a crafted link to a page with an isotope grid that has URL filtering enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2015/
- https://plugins.svn.wordpress.org/the-post-grid/tags/7.9.8/
- https://wordpress.org/plugins/the-post-grid/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS