CVE-2026-94680
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Post Grid plugin in versions up to and including 7.9.5 contains a Cross Site Scripting (XSS) vulnerability exploitable by a Contributor-level user. The flaw allows injection of a malicious script.
Risk Assessment
A Contributor-level user can inject a malicious script that executes in other users' browsers, potentially leading to session or data theft.
Recommendation
Update The Post Grid plugin to a version newer than 7.9.5 as soon as a fix becomes available.
Other vulnerabilities in The Post Grid
See all- CVE-2026-56056Medium
The Post Grid plugin for WordPress by Mamunur Rashid contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 7.9.7.
- CVE-2026-94671Medium
The Post Grid plugin in versions up to and including 7.9.5 contains a Cross Site Scripting (XSS) vulnerability exploitable by a Contributor-level user. The flaw allows injection of a malicious script.
- CVE-2026-49054Medium
The Post Grid plugin by Mamunur Rashid contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects The Post Grid from n/a through 7.9.2.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS