CVE-2026-24370
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Grid plugin for WordPress (up to version 2.8.0) contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that execute in the victim's browser.
Risk Assessment
An attacker can steal credentials, hijack user sessions, or spread malicious content in the context of a trusted site. This can lead to data confidentiality and integrity breaches.
Recommendation
Update The Grid plugin to the latest available version that includes the fix. Additionally, apply the principle of least privilege for users who can publish content.
Other vulnerabilities in The Grid
See all- CVE-2026-28191High
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. Affects versions from n/a through 2.8.0.
- CVE-2026-24369High
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. Affects versions from n/a through 2.8.0.
- CVE-2026-24368Medium
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0.