XSS in The Post Grid

CVE-2026-84151

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.

Vulnerability class: XSS (Cross-Site Scripting)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N.

EPSS exploit prediction

EPSS: 0.002 (4.9th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 4.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

  • The Post Grid

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-84151?
CVE-2026-84151 is a low-severity vulnerability in The Post Grid, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2026-09-24.
How severe is CVE-2026-84151?
Low severity. CVSS v3 base score is 3.5 out of 10.