CVSS: 9.0EPSS: 34%CPEs: 1EXPL: 1CVE-2024-10728 – PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation
https://notcve.org/view.php?id=CVE-2024-10728
15 Nov 2024 — The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the 'install_required_plugin_callback' function in all versions up to, and including, 4.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed an... • https://github.com/RandomRobbieBF/CVE-2024-10728 • CWE-862: Missing Authorization •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5223 – Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-5223
29 May 2024 — The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento The Post Grid Gutenberg Blocks a... • https://plugins.trac.wordpress.org/browser/ultimate-post/tags/4.0.4/addons/custom_font/Custom_Font.php#L13 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 55%CPEs: 1EXPL: 2CVE-2024-5326 – Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update
https://notcve.org/view.php?id=CVE-2024-5326
29 May 2024 — The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator. El comple... • https://github.com/truonghuuphuc/CVE-2024-5326-Poc • CWE-862: Missing Authorization •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3992 – PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-3992
02 Aug 2023 — The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin El plugin PostX de WordPress anterior a la versión 3.0.6 no sanea ni escapa un parámetro antes de devolverlo a la página, lo que provoca un Cross-Site Scripting (XSS) Reflejado que podría utilizarse contra usuarios con privilegios elevados, como los administradores. The PostX - Gutenb... • https://wpscan.com/vulnerability/c43b669f-0377-4402-833c-817b75001888 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36385 – WordPress PostX – Gutenberg Blocks for Post Grid Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-36385
23 Jun 2023 — Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpxpo PostX – Gutenberg Post Grid Blocks plugin <= 2.9.9 versions. The PostX – Gutenberg Blocks for Post Grid plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauth. • https://patchstack.com/database/vulnerability/ultimate-post/wordpress-postx-gutenberg-post-grid-blocks-plugin-2-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24659 – PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24659
26 Aug 2021 — The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. El plugin PostX â€" Gutenberg Blocks for Post Grid de WordPress versiones anteriores a 2.4.10, permite a usuarios con un rol tan bajo como el de Contribuyente llevar a cabo ataques de tipo Cross-Site Scripting Almacenados por medio del bloque del plugin • https://wpscan.com/vulnerability/5f2fe510-7513-4d33-82d9-3107b3b3f2ae • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24660 – PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24660
26 Aug 2021 — The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode. El plugin PostX - Gutenberg Blocks for Post Grid de WordPress versiones anteriores a 2.4.10, con el Complemento de Plantillas Guardadas activado, permite a usuarios con un rol tan bajo como el de Contribuyente llevar a cabo ataques de Cross-Site Scripting almacenado por medio de... • https://wpscan.com/vulnerability/af14ac23-843d-4f80-beaf-237618109edd • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24661 – PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure
https://notcve.org/view.php?id=CVE-2021-24661
26 Aug 2021 — The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID. El plugin PostX - Gutenberg Blocks for Post Grid de WordPress versiones anteriores a 2.4.10, con el Complemento de Plantillas Guardadas habilitado, permite a usuarios con roles de Contribuyente o superiores leer contenidos de publicaciones proteg... • https://wpscan.com/vulnerability/8d966ff1-9c88-43c7-8f4b-93c88e214677 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24652 – PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls
https://notcve.org/view.php?id=CVE-2021-24652
17 Aug 2021 — The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values. El plugin PostX - Gutenberg Blocks for Post Grid de WordPress versiones anteriores a 2.4.10, lleva a cabo comprobaciones incorrectas antes de permitir a cualquier usuario conectado llevar a cabo algunas peticiones basadas en ajax, permitiendo a cualquier usuario modificar, el... • https://wpscan.com/vulnerability/5375bd3e-a30d-4f24-9b17-470b28a8231c • CWE-863: Incorrect Authorization •