WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio plugin <= 2.1.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio plugin versions = 2.1.6. Solution Update the WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio plugin to the late...

WordPress Post Grid for Elementor & Product Grid | PowerGrids plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Post Grid for Elementor & Product Grid | PowerGrids plugin versions = 1.1. Solution Update the WordPress Post Grid for Elementor & Product Grid | PowerGrids plugin to the latest available version at...

WordPress Post Grid 2.1.1 Cross Site Scripting

Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting XSS Date: 3/16/2021 Author: 0xB9 Software Link: https://wordpress.org/plugins/post-grid/ Version: 2.1.1 Tested on: Windows 10 CVE: CVE-2021-24488 1. Description: This plugin creates a post grid from any post types. The slider...

WordPress Post Grid 2.1.1 Plugin - Cross Site Scripting Vulnerability

Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting XSS Author: 0xB9 Software Link: https://wordpress.org/plugins/post-grid/ Version: 2.1.1 Tested on: Windows 10 CVE: CVE-2021-24488 1. Description: This plugin creates a post grid from any post types. The slider import search...

WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)

Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting XSS Date: 3/16/2021 Author: 0xB9 Software Link: https://wordpress.org/plugins/post-grid/ Version: 2.1.1 Tested on: Windows 10 CVE: CVE-2021-24488 1. Description: This plugin creates a post grid from any post types. The slider...

Post Grid < 2.1.13 - Contributor+ SQL Injection

The plugin does not sanitise and escape user input before using it in a SQL statement when duplicating posts available to Contributor+ users, leading to an SQL Injection...

CVE-2021-24659

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

CVE-2021-24652

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values...

CVE-2021-24661

The PostX – Gutenberg Blocks for Post Grid WordPress plugin (before 2.4.10) with the Saved Templates Addon enabled permits users with Contributor roles or higher to read password-protected or private post contents they normally cannot access, given a post ID. This is the confirmed issue described...

CVE-2021-24659 PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The plugin allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. PoC can be entered with code editor the example below uses Taxonomy block; all blocks are vulnerable:...

WordPress PostX – Gutenberg Blocks for Post Grid plugin <= 2.4.9 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress PostX – Gutenberg Blocks for Post Grid plugin versions = 2.4.9. Solution Update the WordPress PostX – Gutenberg Blocks for Post Grid plugin to the latest available version at least 2.4.10...

WordPress PostX – Gutenberg Blocks for Post Grid plugin <= 2.4.9 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress PostX – Gutenberg Blocks for Post Grid plugin versions = 2.4.9. Solution Update the WordPress PostX – Gutenberg Blocks for Post Grid plugin to the latest available version at least 2.4.10...

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The plugin allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. PoC PoC can be entered with code editor the example below uses Taxonomy block; all blocks are vulnerable:...

WordPress PostX – Gutenberg Blocks for Post Grid plugin <= 2.4.9 - Private Content Disclosure vulnerability

Private Content Disclosure vulnerability discovered by apple502j in WordPress PostX – Gutenberg Blocks for Post Grid plugin versions = 2.4.9. Solution Update the WordPress PostX – Gutenberg Blocks for Post Grid plugin to the latest available version at least 2.4.10...

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls

The plugin performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values. You can run this from a browser's javascript console:...

WordPress PostX – Gutenberg Blocks for Post Grid plugin <= 2.4.9 - Missing Access Controls vulnerability

Missing Access Controls vulnerability discovered by apple502j in WordPress PostX – Gutenberg Blocks for Post Grid plugin versions = 2.4.9. Solution Update the WordPress PostX – Gutenberg Blocks for Post Grid plugin to the latest available version at least 2.4.10...

WordPress Post Grid plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Post Grid plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress Po...

CVE-2021-24488

The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues...

CVE-2021-24488

The WordPress Post Grid plugin (pre-2.1.8) contains a reflected XSS, due to improper sanitization of the slider-import search feature and the tab parameter, which are echoed back in pages. Impact: attacker could inject scripts viewed by users. Mitigation: upgrade to version 2.1.8 or higher; apply...