Veille CVE

Recherche « Unknown The Post Grid »

6 CVE

Critique 0 Élevée 0 Moyenne 4 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown The Post Grid » ✕
  1. CVE-2026-104646 6.8 Moyenne

    Unknown Image Photo Gallery Final Tiles Grid

    The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.

  2. CVE-2026-104645 2.7 Faible

    Unknown Image Photo Gallery Final Tiles Grid

    The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.

  3. CVE-2026-84151 3.5 Faible

    Unknown The Post Grid

    The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.

  4. CVE-2026-86783 5.3 Moyenne

    Unknown Post Grid Gutenberg Blocks

    The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.

  5. CVE-2026-16260 6.8 Moyenne

    Unknown Post Grid, Slider & Carousel Ultimate

    The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

  6. CVE-2026-14203 4.8 Moyenne

    Unknown Smart Manager

    The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.