CVE-2026-115955: WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid for WordPress block editor: from n/a through 2.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bPlugins Advanced Post Block - Post Grid for WordPress block editorto a version that resolves this vulnerability.Fixed in 2.5.2
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack vector requires network access, low privileges, and user interaction. This indicates an attacker must be able to act as a low-privileged user and have a victim view or interact with the stored malicious content.
Which plugin versions are affected?
Advanced Post Block - Post Grid for WordPress block editor versions through 2.5.1 are affected. The available data does not identify a fixed version.
What is the likely impact if exploitation succeeds?
This is a stored XSS issue with low confidentiality, integrity, and availability impact. Because scope is changed, the injected script may affect users in a different security context when they view the affected content.