CVE-2026-84151: The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.
Affected Software
Event History
Frequently Asked Questions
Which users can introduce the malicious content?
Users with the Contributor role or higher can store the affected HTML elements in their content.
Who may be exposed when injected content is rendered?
Any visitor viewing the affected content and administrators reviewing it may see the injected iframe, style, or input elements.
Is the broadened HTML allowance limited to this plugin's own markup?
No. The plugin applies the expanded WordPress allowed-HTML list site-wide rather than restricting it to its own markup.
Which releases are affected?
PickPlugins Post Grid versions before 7.9.5 are affected.