CVE-2026-84151 - The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening · CoreCVE

Back Back to CVE browser

LOW

The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

Published Sep 24, 2026

3.5

LOW

CVSS 3.1

EPSS 0.14%

Description

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.

Affected products

Vendor n/a Product The Post Grid Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.9.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

The Post Grid

unaffected

Version	Status	Constraints
0	affected	<7.9.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://wpscan.com/vulnerability/6601a305-a76f-40fe-8d78-c6a33a66d5f3/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/6601a305-a76f-40fe-8d78-c6a33a66d5f3/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 24, 2026

Updated Sep 24, 2026

Reserved Sep 1, 2026

Link CVE-2026-84151

CISA Vulnrichment

Updated Sep 24, 2026

Status Received

Modified Sep 24, 2026

Link CVE-2026-84151

Severity n/a

Public date n/a

Links CVE-2026-84151