CVE-2026-84151
Low
Description
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.
SeverityLow
CVSS3.5
Exploit probability—
ProductThe Post Grid
PublishedSep 24, 2026
First seenSep 24, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- The Post Grid7.9.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| The Post Grid | v < 7.9.5 | 7.9.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.