CVE-2026-119160

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This...

CVE-2026-119160

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.0.9 . The root cause is insufficient input sanitization and output escaping involving the display_name ...

CVE-2026-119160 Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This...

CVE-2026-119160 Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This...

EUVD-2026-114674

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This...

WordPress Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jacek Sowiński dzaku in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions = 4.0.9...

CVE-2026-119160: shapedplugin: The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is…

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This...

PT-2026-134490

Name of the Vulnerable Software and Affected Versions The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News versions prior to 4.1.0 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and abov...

CVE-2026-78149

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...

CVE-2026-78150

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

CVE-2026-78150

The Smart Post WordPress plugin (versions 4.0.0-4.0.7 ) is vulnerable to an IDOR flaw because it fails to verify the type, ownership, or status of a post during the duplication process. This allows users with contributor privileges or higher to copy any private or password-protected post into the...

EUVD-2026-71850

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

WordPress Smart Post plugin 4.0.0-4.0.7 - Contributor+ Private and Protected Post Content Disclosure vulnerability

Contributor+ Private and Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

CVE-2026-78149 Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure via sp_handle_post_id

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...

EUVD-2026-71849

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...

WordPress Smart Post plugin 4.0.0-4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure vulnerability

Unauthenticated Password-Protected Post Content and postpassword Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

PT-2026-86332

🚨 CVE-2026-78149 The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards...

CVE-2026-78150: Authorization Bypass Through User-Controlled Key

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

CVE-2026-78149: Exposure of Sensitive Information to an Unauthorized Actor

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it...

PT-2026-86333

🚨 CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and...