CVE-2026-94671: WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
Published Sep 23, 2026
·Updated
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
Affected Software
1 affected component
PickPlugins The Post Grid<=7.9.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress The Post Grid pluginto a version that resolves this vulnerability.Fixed in 7.9.6
Event History
Sep 23, 2026
CVE Published
via MITRE·06:14 PM
Data Sourced
via MITRE·06:14 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who needs to be able to interact with the site for exploitation to be possible?
An attacker needs Contributor-level access to the WordPress site. The attack also requires a user to interact with the injected content, as indicated by the UI:R vector.
2
What security impact can successful exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability, each at low impact. The scope may extend beyond the vulnerable plugin component, as indicated by S:C.
3
Which plugin versions are identified as affected?
The affected range is The Post Grid versions 7.9.5 and earlier.