Vulnerability · Published Sep 24, 2026 · Assigned by WPScan

CVE-2026-84151The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening

Low 3.5

In plain English

A low-severity cross-site scripting in The Post Grid from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.

Affected products (as reported)

Vendor	Product	Versions
Unknown	The Post Grid	0 – before 7.9.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/6601a305-a76f-40fe-8d78-c6a33a66d5f3/ exploit, vdb-entry, technical-description