CVE-2026-84151: Post Grid WordPress Plugin XSS Vulnerability

CVE-2026-84151 Overview

CVE-2026-84151 affects The Post Grid WordPress plugin in versions prior to 7.9.5. The plugin expands the WordPress allowed-HTML list beyond its own markup and applies the expansion site-wide. Authenticated users with the Contributor role or higher can store iframe, style, and input elements that WordPress normally strips from post content. The stored markup renders to any site visitor and to administrators reviewing submitted content. The flaw is categorized as HTML injection [CWE-79] and enables phishing frames, CSS defacement, and spoofed input forms.

Critical Impact
Contributor-level accounts can plant persistent HTML payloads that render to visitors and administrators, enabling phishing and content spoofing against the site.

Affected Products

The Post Grid WordPress plugin, all versions before 7.9.5
WordPress sites that expose Contributor or higher roles to untrusted users
Any front-end page or admin review view that renders Post Grid content

Discovery Timeline

2026-09-24 - CVE-2026-84151 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-84151

Vulnerability Analysis

The Post Grid plugin extends the WordPress wp_kses allowed-HTML list to permit tags required by its own shortcodes and templates. The extension is applied globally rather than scoped to the plugin's own rendering context. As a result, the expanded tag allowlist persists for every post, page, and comment processed through standard content filters. Contributors, who are normally restricted to a safe subset of HTML, can submit iframe, style, and input elements that are preserved during save and render.

The stored content is served to end users through standard WordPress output paths. An iframe can load attacker-controlled origins inside the trusted site chrome. A style block can rewrite layout, hide legitimate content, or overlay fake notices. An input element can present credential or payment fields that post to attacker endpoints. Impact is limited to confidentiality and integrity because scripts are still filtered, but social-engineering payloads remain fully viable.

Root Cause

The root cause is an overly broad modification of the WordPress HTML allowlist. The plugin registers additional permitted tags through a global filter without restricting the filter to its own shortcodes or templates. This violates the principle of least privilege for content sanitization and bypasses WordPress's role-based HTML restrictions for Contributor accounts.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher. The attacker crafts post content containing iframe, style, or input elements and submits it through the standard post editor or REST API. The payload is stored verbatim and rendered to any visitor who views the post, as well as to administrators who open the draft for review. User interaction is required for the social-engineering payload to succeed, consistent with the published CVSS vector.

No verified public exploit code is available at the time of writing. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-84151

Indicators of Compromise

Posts, pages, or custom post types containing <iframe>, <style>, or standalone <input> tags authored by Contributor-level accounts
Unexpected outbound framing of third-party origins from WordPress rendered pages
Administrator sessions reporting layout anomalies or unfamiliar form fields on draft content

Detection Strategies

Query the wp_posts table for post_content matching <iframe, <style, or <input across posts authored by non-Editor roles
Review web server access logs for referers pointing to WordPress post URLs that load unexpected third-party domains in frames
Audit the installed version of The Post Grid plugin and flag any instance below 7.9.5

Monitoring Recommendations

Enable WordPress audit logging for post create and update events, correlated with user role
Monitor Content Security Policy violation reports for frame-src and style-src breaches on pages rendered by the plugin
Alert on new Contributor account creation followed by rapid post submission

How to Mitigate CVE-2026-84151

Immediate Actions Required

Upgrade The Post Grid plugin to version 7.9.5 or later on every WordPress instance
Review all posts authored by Contributor accounts since the plugin was installed and remove disallowed HTML elements
Rotate credentials for any Contributor account that cannot be attributed to a known operator

Patch Information

The vendor addressed the issue in The Post Grid version 7.9.5 by scoping the allowed-HTML expansion to the plugin's own rendering context. Administrators should update through the WordPress plugin dashboard or by replacing the plugin directory with the fixed release. Confirm the installed version in wp-admin/plugins.php after update.

Workarounds

Restrict Contributor and Author role assignment to trusted users until the patch is applied
Deploy a Content Security Policy that denies frame-src and restricts inline style on front-end pages
Temporarily disable The Post Grid plugin on sites that accept content from untrusted contributors

bash

# Verify installed plugin version with WP-CLI
wp plugin get post-grid --field=version

# Update to the patched release
wp plugin update post-grid --version=7.9.5

# Audit stored posts for disallowed tags
wp db query "SELECT ID, post_author, post_status FROM wp_posts WHERE post_content REGEXP '<(iframe|style|input)[^>]*>';"