CVE-2024-9645

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.1%

top 65.85%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Pickplugins Post Grid

Timeline

PublishedMay 15

Description

The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages1 packages

▶NVDpickplugins/post_grid< 2.2.93

🔴Vulnerability Details

CVEList

Post Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSS↗2025-05-15

▶

GHSA

GHSA-w4w8-5w5f-5gvr: The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2↗2025-05-15

▶