CVE-2026-15100
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Post Grid Gutenberg Blocks – PostX plugin for WordPress up to version 5.0.32 is vulnerable to stored XSS via the 'searchnoresult' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute when an editor or administrator previews the page.
Risk Assessment
The risk involves arbitrary JavaScript execution in the browser session of an editor or administrator, potentially leading to session theft, content modification, or privilege escalation.
Recommendation
Immediately update the PostX plugin to the latest version and restrict user permissions to the minimum necessary.
Other vulnerabilities in Post Grid Gutenberg Blocks – PostX
Original NVD description (English source)
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS