# The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.9.7 - Unauthenticated DOM-Based Cross-Site Scripting via URL Fragment

- **ID:** WPSEC-2026-2015
- **Plugin:** The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid (`the-post-grid`), https://wordpress.org/plugins/the-post-grid/
- **Affected versions:** all versions before 7.9.8
- **Fixed in:** 7.9.8 (Update to 7.9.8 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/the-post-grid
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2015/

## Description

The The Post Grid plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the URL fragment (location.hash) in all versions up to, and including, 7.9.7. The isotope 'filter in URL' handler passed the hash unchecked to the isotope filter and into a jQuery selector string. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in a victim's browser if they can trick the victim into opening a crafted link to a page with an isotope grid that has URL filtering enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2015/
- https://plugins.svn.wordpress.org/the-post-grid/tags/7.9.8/
- https://wordpress.org/plugins/the-post-grid/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2015/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.