Description

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-06T12:16:27.483Z",
  "pubdate": "2026-08-06T12:16:27.483Z",
  "executiveSummary": "The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. The flaw exists in all versions up to, and including, 5.0.13, arising from the inadequate sanitization of user-supplied input and the absence of proper output escaping mechanisms.\nThe vulnerability allows authenticated threat actors possessing Contributor-level privileges or higher to inject arbitrary web scripts, including malicious JavaScript payloads, into application pages through the vulnerable parameter. When targeted users access the injected pages, the malicious scripts execute within the context of their browsers.\nThis creates significant risk implications, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victimized user. Exploitation of this vulnerability requires authenticated access with specific privilege levels, but does not necessitate complex interaction beyond the victim navigating to the compromised page.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), stemming from insufficient input validation and missing context-aware output encoding within the PostX plugin for WordPress. Specifically, the flaw is exposed via the 'inputPlaceHolder' parameter processed by the application.\nThe vulnerable component fails to adequately sanitize input supplied to the 'inputPlaceHolder' parameter before persisting the data within the database or rendering it back to the client interface. Consequently, when an attacker submits specially crafted payloads containing malicious JavaScript via this parameter, the input is stored persistently.\nThe attack flow proceeds as follows: First, an authenticated attacker with Contributor-level access or higher crafts an HTTP request containing malicious script payloads targeting the 'inputPlaceHolder' parameter within the affected PostX block configuration. Second, the application accepts and stores the un-sanitized input within the database without applying stringent filtering or validation routines. Third, when any user or administrative entity requests the affected page containing the rendered PostX block, the server retrieves the malicious payload and reflects it into the HTTP response without proper output escaping.\nUpon rendering, the victim's browser interprets the injected string as executable code, executing the payload within the Document Object Model (DOM) of the vulnerable site. Because the execution occurs in the security context of the victim's browser session, the attacker can leverage this capability to perform unauthorized actions, access sensitive session cookies, or manipulate the application interface.\nThe affected product is the PostX plugin for WordPress, covering all versions up to, and including, 5.0.13. Exploitation requires network access to the WordPress administrative or front-end editor interface, along with authenticated access holding at least Contributor-level privileges."
}