4079 matches found
CVE-2026-16260
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
WordPress Post Grid, Slider & Carousel Ultimate plugin < 1.8.1 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Post Grid, Slider & Carousel Ultimate versions 1.8.1...
CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
CVE-2026-16260
The Post Grid, Slider & Carousel Ultimate WordPress plugin, in versions prior to 1.8.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The flaw exists because the plugin fails to properly sanitise and escape a custom post type setting before rendering it within an HTML attribute on...
EUVD-2026-64216
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
CVE-2026-16260: Improper Neutralization of Input During Web Page Generation
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
CVE-2026-4559: Improper Neutralization of Input During Web Page Generation
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
PT-2026-79507
Name of the Vulnerable Software and Affected Versions Post Grid, Slider & Carousel Ultimate versions prior to 1.8.1 Description Insufficient sanitization and escaping of a custom post type setting allows users with the Contributor role and above to perform a stored Cross-Site Scripting XSS attack...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834: Heap-based Buffer Overflow
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-28191
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...
CVE-2026-28191
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...
CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...
EUVD-2026-60890
Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...
CVE-2026-28191
A privilege escalation vulnerability affects the WordPress plugin The Grid (versions
CVE-2026-28191: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0...