Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PoC

Create a new Grid/Caroussel, in the General Settings, enable “Display Header Title” and put the following payload in the “Header Title” field: The XSS will be triggered when viewing the Post Grid/Carousel in the post.