Post Grid WordPress Plugin Pre-Auth Contributor+ Stored XSS via Header Title Field (CVE-2026-16260)

Vulnerability Overview Vulnerability Name: Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field Description: The plugin fails to properly sanitize and escape custom post type settings when outputting them to HTML attributes. This allows users with the Contributor role and above to inject and execute JavaScript code when an administrator opens the affected item. CVE Number: CVE-2026-16260 Type: XSS (Cross-Site Scripting) OWASP Top 10: A7: Cross-Site Scripting (XSS) CWE: CWE-79 CVSS Score: 6.8 (medium) Affected Range Affected Plugin: Post Grid, Slider & Carousel Ultimate Fixed Version: 1.8.1 Remediation Fixed Version: Upgrade to version 1.8.1 or higher. Timeline Public Disclosure Date: 2026-08-20 Addition Date: 2026-08-20 Last Update Date: 2026-08-20 Additional Information Original Researcher: Yaswanth Reddy Sunkara Submitter: Yaswanth Reddy Sunkara Verification Status: Yes WPVDB ID: 87c95831-d1b4-42b2-8fc7-6cba60fca400 Related Vulnerabilities WordPress GDPR & CCPA < 1.9.27: Unauthenticated Reflected Cross-Site Scripting Void Contact Form 7 Widget For Elementor Page Builder < 2.4.1: Authenticated (Contributor+) Stored Cross-Site Scripting via c7_redirect_page Attribute Elementor Website Builder < 3.22.2: Contributor+ Arbitrary SVG Download Connect Contact Form 7 and Mailchimp < 0.9.78.07: Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values MailArchiver < 4.5.0: Authenticated (Administrator+) Stored Cross-Site Scripting via Settings POC Code No specific POC code is provided on the page, but it mentions that the POC will be demonstrated on September 3, 2026, to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

Post Grid WordPress Plugin Pre-Auth Contributor+ Stored XSS via Header Title Field (CVE-2026-16260)

More from this source