VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 29 known issues Latest disclosed Dec 21, 2025

Post Grid Vulnerabilities

Review known vulnerability records for the WordPress plugin Post Grid (`post-grid`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-68605, CVE-2025-63043 and CVE-2025-66058, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
29
High or Critical
7
Patch Coverage
100%
Last Updated
Apr 30, 2026
Related Security Guides

Use these guides while reviewing Post Grid fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Post Grid remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
29
1. Match the Package
Confirm the installed WordPress plugin slug is post-grid before acting on any CVE from this cluster.
2. Sort by Severity
Start with 7 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
29 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2024-9636 Critical
Privilege Escalation remediation for Post Grid

Affected range: 2.2.85 through 2.3.3. Fixed version: 2.3.4.

CVE-2025-54007 High
Vulnerability remediation for Post Grid

Affected range: Versions up to 2.3.11. Fixed version: 2.3.12.

CVE-2024-8253 High
Privilege Escalation remediation for Post Grid

Affected range: 2.2.87 through 2.2.90. Fixed version: 2.2.91.

CVE-2021-4450 High
SQL Injection remediation for Post Grid

Affected range: Versions before 2.1.13. Fixed version: 2.1.13.

Priority CVE Quick Links

Fast paths into Post Grid CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
28
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2024-9636
Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation
 Privilege Escalation 2.2.85 through 2.3.3 2.3.4 CVSS 9.8
CVE-2025-54007
Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object I...
 Vulnerability Versions up to 2.3.11 2.3.12 CVSS 8.8
CVE-2024-8253
Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privile...
 Privilege Escalation 2.2.87 through 2.2.90 2.2.91 CVSS 8.8
CVE-2021-4450
Post Grid <= 2.1.12 - Contributor+ SQL Injection
 SQL Injection Versions before 2.1.13 2.1.13 CVSS 8.8
CVE-2023-7072
Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_post...
 Sensitive Information Exposure Versions up to 2.2.68 2.2.69 CVSS 7.5
CVE-2023-40211
Post Grid <= 2.2.50 - Missing Authorization to Sensitive Information Exposure via R...
 Sensitive Information Exposure Versions up to 2.2.50 2.2.51 CVSS 7.5
CVE-2025-68605
Post Grid and Gutenberg Blocks <= 2.3.21 - Authenticated (Contributor+) Stored Cross...
 Stored Cross-Site Scripting Versions up to 2.3.21 No patch listed CVSS 6.4
CVE-2024-9645
Post Grid and Gutenberg Blocks <= 2.2.92 - Authenticated (Contributor+) Stored Cross...
 Stored Cross-Site Scripting Versions up to 2.2.92 2.2.93 CVSS 6.4
CVE-2024-9636 Critical 2.3.4
CVE-2024-9636 Post Grid Privilege Escalation

Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation

CVE-2025-54007 High 2.3.12
CVE-2025-54007 Post Grid Vulnerability

Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection

CVE-2024-8253 High 2.2.91
CVE-2024-8253 Post Grid Privilege Escalation

Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation

CVE-2021-4450 High 2.1.13
CVE-2021-4450 Post Grid SQL Injection

Post Grid <= 2.1.12 - Contributor+ SQL Injection

CVE-2023-7072 High 2.2.69
CVE-2023-7072 Post Grid Sensitive Information Exposure

Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint

CVE-2023-40211 High 2.2.51
CVE-2023-40211 Post Grid Sensitive Information Exposure

Post Grid <= 2.2.50 - Missing Authorization to Sensitive Information Exposure via REST API

CVE-2025-68605 Medium No patch listed
CVE-2025-68605 Post Grid Stored Cross-Site Scripting

Post Grid and Gutenberg Blocks <= 2.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-9645 Medium 2.2.93
CVE-2024-9645 Post Grid Stored Cross-Site Scripting

Post Grid and Gutenberg Blocks <= 2.2.92 - Authenticated (Contributor+) Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Post Grid so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
29 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
2 critical and 5 high severity findings.
Recent CVEs
CVE-2025-68605, CVE-2025-63043 and CVE-2025-66058
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Post Grid

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: No CVE-2025-68605
CVE-2025-68605: Post Grid and Gutenberg Blocks <= 2.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Published
Dec 21, 2025
Patched Release
Not published
Affected Versions
Versions up to 2.3.21
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-68605 fixed version details Open CVE Reference
Plugin Medium Patched: No CVE-2025-63043
CVE-2025-63043: Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object Reference

The Post Grid plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.19 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Published
Dec 03, 2025
Patched Release
Not published
Affected Versions
Versions up to 2.3.19
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-63043 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-66058
CVE-2025-66058: Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization

The Post Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthor...

Published
Oct 04, 2025
Patched Release
2.3.18
Affected Versions
Versions up to 2.3.17
Next Step
Update to 2.3.18 or newer if supported.
Review CVE-2025-66058 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-62924
CVE-2025-62924: Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.17. This makes it possible for authenticated attackers, with contributor-level access and above, to p...

Published
Oct 04, 2025
Patched Release
2.3.18
Affected Versions
Versions up to 2.3.17
Next Step
Update to 2.3.18 or newer if supported.
Review CVE-2025-62924 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-54007
CVE-2025-54007: Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3.11 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a...

Published
Aug 06, 2025
Patched Release
2.3.12
Affected Versions
Versions up to 2.3.11
Next Step
Update to 2.3.12 or newer if supported.
Review CVE-2025-54007 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13796
CVE-2024-13796: Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attackers to extract sensi...

Published
Feb 27, 2025
Patched Release
2.3.7
Affected Versions
Versions up to 2.3.6
Next Step
Update to 2.3.7 or newer if supported.
Review CVE-2024-13796 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13798
CVE-2024-13798: Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create...

Published
Feb 21, 2025
Patched Release
2.3.6
Affected Versions
Versions up to 2.3.5
Next Step
Update to 2.3.6 or newer if supported.
Review CVE-2024-13798 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2024-9636
CVE-2024-9636: Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated atta...

Published
Jan 14, 2025
Patched Release
2.3.4
Affected Versions
2.2.85 through 2.3.3
Next Step
Update to 2.3.4 or newer if supported.
Review CVE-2024-9636 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-9645
CVE-2024-9645: Post Grid and Gutenberg Blocks <= 2.2.92 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.92 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Published
Jan 14, 2025
Patched Release
2.2.93
Affected Versions
Versions up to 2.2.92
Next Step
Update to 2.2.93 or newer if supported.
Review CVE-2024-9645 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-50432
CVE-2024-50432: Post Grid and Gutenberg Blocks <= 2.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.93 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Published
Oct 24, 2024
Patched Release
2.2.94
Affected Versions
Versions up to 2.2.93
Next Step
Update to 2.2.94 or newer if supported.
Review CVE-2024-50432 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-47340
CVE-2024-47340: Post Grid and Gutenberg Blocks <= 2.2.89 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Published
Sep 27, 2024
Patched Release
2.2.90
Affected Versions
Versions up to 2.2.89
Next Step
Update to 2.2.90 or newer if supported.
Review CVE-2024-47340 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2024-8253
CVE-2024-8253: Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it possible for authen...

Published
Sep 10, 2024
Patched Release
2.2.91
Affected Versions
2.2.87 through 2.2.90
Next Step
Update to 2.2.91 or newer if supported.
Review CVE-2024-8253 fixed version details Open CVE Reference