{
 "id": "WPSEC-2026-2015",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2015/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2015/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2015/index.md",
 "title": "The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.7 - Unauthenticated DOM-Based Cross-Site Scripting via URL Fragment",
 "description": "The The Post Grid plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the URL fragment (location.hash) in all versions up to, and including, 7.9.7. The isotope 'filter in URL' handler passed the hash unchecked to the isotope filter and into a jQuery selector string. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in a victim's browser if they can trick the victim into opening a crafted link to a page with an isotope grid that has URL filtering enabled.",
 "plugin": {
  "slug": "the-post-grid",
  "name": "The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid",
  "full_name": "The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid",
  "wordpress_org": "https://wordpress.org/plugins/the-post-grid/",
  "advisories_url": "https://wpsec.com/vuln/plugin/the-post-grid/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/the-post-grid"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.9.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.9.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.9.8",
 "remediation": "Update to 7.9.8 or later.",
 "fix_released": "2026-10-29T09:11:12+00:00",
 "published": "2026-10-30T09:42:55+00:00",
 "updated": "2026-10-29T17:42:06.088967+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2015/",
  "https://plugins.svn.wordpress.org/the-post-grid/tags/7.9.8/",
  "https://wordpress.org/plugins/the-post-grid/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/the-post-grid",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}