Input validation

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values...

CVE-2021-24652

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values...

CVE-2021-24661 PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID...

CVE-2021-24661

The PostX – Gutenberg Blocks for Post Grid WordPress plugin (before 2.4.10) with the Saved Templates Addon enabled permits users with Contributor roles or higher to read password-protected or private post contents they normally cannot access, given a post ID. This is the confirmed issue described...

CVE-2021-24660

CVE-2021-24660 affects the WordPress plugin pair: PostX – Gutenberg Blocks for Post Grid with the Saved Templates Addon enabled, versions before 2.4.10. The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin’s shortcode, allowing users with a role as low as Contributor to inject ...

CVE-2021-24660 PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode...

CVE-2021-24659 PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

CVE-2021-24659

The CVE-2021-24659 entry concerns the WordPress plugin PostX – Gutenberg Blocks for Post Grid (versions before 2.4.10). The vulnerability allows stored cross-site scripting via the plugin’s blocks with user roles as low as Contributor. Root cause: input handling in the Block context enables injec...

CVE-2021-24652 PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values...

CVE-2021-24652

CVE-2021-24652 (PostX – Gutenberg Blocks for Post Grid) affects the WordPress plugin PostX – Gutenberg Blocks for Post Grid, prior to version 2.4.10. The vulnerability arises from missing/incorrect access controls in certain AJAX requests, allowing any logged-in user to modify, delete, or add val...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin PostX, which stems from versions of the PostX Gutenberg Blocks for Post Grid WordPress plugin prior to 2.4.10 that enable the Saved Templates Addon, which allow...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin PostX, which stems from the PostX - Gutenberg Blocks for Post Grid WordPress plugin prior to 2.4.10 allows users with roles as low as Contributor to execute a...

WordPress plugin PostX Gutenberg Blocks Saved Templates Addon 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin PostX...

WordPress 插件 访问控制错误漏洞

WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin PostX, which stems from Gutenberg Blocks in the Post Grid WordPress plugin prior to PostX - version 2.4.10 allows any logged in user to perform error checking before...

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The plugin allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. PoC can be entered with code editor the example below uses Taxonomy block; all blocks are vulnerable:...

PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The plugin, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode. Create a page as any user with the following shortcode block: gutenbergpostblocks id='a"...

PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The plugin, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode. PoC Create a page as any user with the following shortcode block: gutenbergpostblocks id='a"...

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The plugin allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. PoC PoC can be entered with code editor the example below uses Taxonomy block; all blocks are vulnerable:...

WordPress PostX – Gutenberg Blocks for Post Grid plugin <= 2.4.9 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress PostX – Gutenberg Blocks for Post Grid plugin versions = 2.4.9. Solution Update the WordPress PostX – Gutenberg Blocks for Post Grid plugin to the latest available version at least 2.4.10...

PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure

The plugin, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID. If the post 1234, created by other users, is set as private, save gutenbergpostblocks id="1234...