CVE-2026-84151 Overview
CVE-2026-84151 is an HTML injection vulnerability in The Post Grid WordPress plugin versions before 7.9.5. The plugin extends the WordPress allowed-HTML list beyond its own markup and applies the expansion site-wide. Authenticated users with the Contributor role or higher can store iframe, style, and input elements in content that WordPress would normally strip. The injected markup renders to any site visitor and to administrators reviewing the content, enabling phishing frames, CSS defacement, and spoofed input forms. The flaw is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level accounts can persist HTML that renders in visitor and admin browsers, enabling phishing overlays and page defacement.
Affected Products
- The Post Grid WordPress plugin versions before 7.9.5
- WordPress sites permitting Contributor or higher role registration
- Any site rendering content authored through the vulnerable plugin
Discovery Timeline
- 2026-09-24 - CVE-2026-84151 published to the National Vulnerability Database
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-84151
Vulnerability Analysis
The Post Grid plugin needs to render richer HTML than the WordPress default allows for its own grid markup. To support that markup, the plugin extends the global allowed-HTML list used by wp_kses and related sanitization functions. The extension is not scoped to the plugin's own output paths and instead applies across the entire site.
Once the allowed-HTML list is expanded globally, WordPress no longer strips iframe, style, and input tags from content authored by low-privilege users. Contributors normally have their submissions filtered because they cannot publish unmoderated HTML. The vulnerability removes that filtering assumption while leaving the Contributor workflow otherwise unchanged.
The stored content renders in three high-value surfaces: public visitor pages, administrator preview and review screens, and any front-end template that echoes post content. This creates opportunities for phishing frames loaded from attacker domains, style blocks that reflow legitimate elements, and spoofed input fields that capture credentials submitted by trusted users.
Root Cause
The root cause is an over-broad modification of the wp_kses_allowed_html filter. The plugin should register additional tags only for its own render context, but instead alters the global filter used by all post content sanitization. Contributor role submissions inherit the expanded allowlist.
Attack Vector
An attacker authenticated as a Contributor submits a draft or post containing an iframe, style, or input element. The plugin's filter keeps the markup intact through the standard sanitization pipeline. When an administrator previews the submission or a visitor loads a page that includes the content, the browser parses and renders the injected HTML. See the WPScan Vulnerability Report for the technical write-up.
Detection Methods for CVE-2026-84151
Indicators of Compromise
- Post content containing <iframe>, <style>, or <input> tags authored by users below the Editor role.
- Outbound iframe references to domains unrelated to the site's normal media or embed sources.
- Draft or pending posts from Contributor accounts that include form-like markup or off-site resource loads.
Detection Strategies
- Query the WordPress wp_posts table for stored HTML tags that Contributors should not be able to persist.
- Review plugin version metadata across managed WordPress installations for The Post Grid builds earlier than 7.9.5.
- Inspect rendered pages with automated crawlers to flag unexpected iframe, style, or input elements introduced by post content.
Monitoring Recommendations
- Alert on new or modified posts submitted by Contributor accounts, particularly drafts pending review.
- Log administrator preview activity so that suspicious content viewed in the admin context can be reconstructed.
- Monitor web server access logs for outbound requests initiated from pages hosting user-submitted grid content.
How to Mitigate CVE-2026-84151
Immediate Actions Required
- Upgrade The Post Grid plugin to version 7.9.5 or later on every WordPress site where it is installed.
- Audit existing posts for stored iframe, style, and input markup and remove any submissions from untrusted contributors.
- Review Contributor accounts for signs of abuse and reset credentials where suspicious content was submitted.
Patch Information
The vendor addressed the issue in The Post Grid version 7.9.5. The fix limits the expanded allowed-HTML list to the plugin's own rendering context so Contributor submissions are again sanitized by the WordPress default policy. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict user registration and limit Contributor role assignment to trusted authors until the plugin is updated.
- Temporarily deactivate The Post Grid plugin on sites where an immediate upgrade is not feasible.
- Apply a Web Application Firewall rule that strips iframe, style, and input tags from post submissions by non-Editor roles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
