VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 29 known issues Latest disclosed Dec 21, 2025

Post Grid Vulnerabilities

Review known vulnerability records for the WordPress plugin Post Grid (`post-grid`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-68605, CVE-2025-63043 and CVE-2025-66058, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
29
High or Critical
7
Patch Coverage
100%
Last Updated
Apr 30, 2026
Priority CVE Quick Links

Fast paths into Post Grid CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
28
CVE-2024-9636 Critical 2.3.4
CVE-2024-9636 Post Grid Privilege Escalation

Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation

CVE-2025-54007 High 2.3.12
CVE-2025-54007 Post Grid Vulnerability

Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection

CVE-2024-8253 High 2.2.91
CVE-2024-8253 Post Grid Privilege Escalation

Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation

CVE-2021-4450 High 2.1.13
CVE-2021-4450 Post Grid SQL Injection

Post Grid <= 2.1.12 - Contributor+ SQL Injection

CVE-2023-7072 High 2.2.69
CVE-2023-7072 Post Grid Sensitive Information Exposure

Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint

CVE-2023-40211 High 2.2.51
CVE-2023-40211 Post Grid Sensitive Information Exposure

Post Grid <= 2.2.50 - Missing Authorization to Sensitive Information Exposure via REST API

CVE-2025-68605 Medium No patch listed
CVE-2025-68605 Post Grid Stored Cross-Site Scripting

Post Grid and Gutenberg Blocks <= 2.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2024-9645 Medium 2.2.93
CVE-2024-9645 Post Grid Stored Cross-Site Scripting

Post Grid and Gutenberg Blocks <= 2.2.92 - Authenticated (Contributor+) Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Post Grid so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
29 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
2 critical and 5 high severity findings.
Recent CVEs
CVE-2025-68605, CVE-2025-63043 and CVE-2025-66058
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Post Grid

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: No CVE-2025-68605
CVE-2025-68605: Post Grid and Gutenberg Blocks <= 2.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Published
Dec 21, 2025
Patched Release
Not published
Affected Versions
Versions up to 2.3.21
Next Step
Open the full report for remediation notes and references.
Open CVE-2025-68605 Report Open CVE Reference
Plugin Medium Patched: No CVE-2025-63043
CVE-2025-63043: Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object Reference

The Post Grid plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.19 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Published
Dec 03, 2025
Patched Release
Not published
Affected Versions
Versions up to 2.3.19
Next Step
Open the full report for remediation notes and references.
Open CVE-2025-63043 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-66058
CVE-2025-66058: Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization

The Post Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthor...

Published
Oct 04, 2025
Patched Release
2.3.18
Affected Versions
Versions up to 2.3.17
Next Step
Update to 2.3.18 or newer if supported.
Open CVE-2025-66058 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-62924
CVE-2025-62924: Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.17. This makes it possible for authenticated attackers, with contributor-level access and above, to p...

Published
Oct 04, 2025
Patched Release
2.3.18
Affected Versions
Versions up to 2.3.17
Next Step
Update to 2.3.18 or newer if supported.
Open CVE-2025-62924 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-54007
CVE-2025-54007: Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3.11 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a...

Published
Aug 06, 2025
Patched Release
2.3.12
Affected Versions
Versions up to 2.3.11
Next Step
Update to 2.3.12 or newer if supported.
Open CVE-2025-54007 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13796
CVE-2024-13796: Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attackers to extract sensi...

Published
Feb 27, 2025
Patched Release
2.3.7
Affected Versions
Versions up to 2.3.6
Next Step
Update to 2.3.7 or newer if supported.
Open CVE-2024-13796 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13798
CVE-2024-13798: Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create...

Published
Feb 21, 2025
Patched Release
2.3.6
Affected Versions
Versions up to 2.3.5
Next Step
Update to 2.3.6 or newer if supported.
Open CVE-2024-13798 Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2024-9636
CVE-2024-9636: Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated atta...

Published
Jan 14, 2025
Patched Release
2.3.4
Affected Versions
2.2.85 through 2.3.3
Next Step
Update to 2.3.4 or newer if supported.
Open CVE-2024-9636 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-9645
CVE-2024-9645: Post Grid and Gutenberg Blocks <= 2.2.92 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.92 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Published
Jan 14, 2025
Patched Release
2.2.93
Affected Versions
Versions up to 2.2.92
Next Step
Update to 2.2.93 or newer if supported.
Open CVE-2024-9645 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-50432
CVE-2024-50432: Post Grid and Gutenberg Blocks <= 2.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.93 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Published
Oct 24, 2024
Patched Release
2.2.94
Affected Versions
Versions up to 2.2.93
Next Step
Update to 2.2.94 or newer if supported.
Open CVE-2024-50432 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-47340
CVE-2024-47340: Post Grid and Gutenberg Blocks <= 2.2.89 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc...

Published
Sep 27, 2024
Patched Release
2.2.90
Affected Versions
Versions up to 2.2.89
Next Step
Update to 2.2.90 or newer if supported.
Open CVE-2024-47340 Report Open CVE Reference
Plugin High Patched: Yes CVE-2024-8253
CVE-2024-8253: Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it possible for authen...

Published
Sep 10, 2024
Patched Release
2.2.91
Affected Versions
2.2.87 through 2.2.90
Next Step
Update to 2.2.91 or newer if supported.
Open CVE-2024-8253 Report Open CVE Reference