Security Alert Summary
The Post Grid WordPress plugin before 7.9.5 improperly expands WordPress allowed-HTML handling to site-wide content. This allows users with the Contributor role and above to store elements such as <iframe>, <style>, and <input> that are normally removed, leading to HTML injection that can render phishing frames, CSS defacement, or spoofed input forms to site visitors and administrators reviewing content.
CVE Details
- CVE ID:
CVE-2026-84151 - Affected component: The Post Grid WordPress plugin
- Affected versions: Versions before 7.9.5 (“less than 7.9.5”)
- Published: September 24, 2026 at 06:17:01 AM UTC
- Last modified: September 24, 2026 at 02:42:02 PM UTC
- CVSS v3.1 base score: 3.5
- CVSS v3.1 severity: LOW
- CVSS v3.1 vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
- Authentication / privileges / user interaction:
- Privileges required: HIGH
- User interaction: REQUIRED
- Attack vector: NETWORK
- Attack complexity: LOW
- Primary impact:
- Confidentiality: LOW
- Integrity: LOW
- Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability arises because the plugin expands WordPress’ allowed-HTML list beyond the plugin’s own markup and applies that expansion site-wide. As a result, user-supplied content from accounts with the Contributor role and above can include elements that are normally stripped by WordPress sanitization, specifically <iframe>, <style>, and <input> elements.
Because these elements are stored and rendered, an attacker with the required privileges can inject HTML that displays to any visitor and to administrators when reviewing content. The JSON description identifies HTML injection vectors such as phishing frames, CSS-based defacement, and spoofed input forms as specific impacts observed when the plugin allows these elements.
No specific functions or REST API endpoints are named in the provided data. The root cause described is a failure to restrict the plugin’s allowed-HTML modifications to its own content scope, resulting in site-wide application of the relaxed HTML policy.
How This Could Impact Your Website
Consider a site with a site owner, internal editors, and external contributors or contractors. If a contributor account is able to save content containing an <iframe> or a spoofed <input> form, that content can be viewed by regular visitors and by administrators reviewing posts. Practical consequences include the exposure of internal user email addresses and contact information (if included in content or visible on pages), and an increased risk of targeted phishing or social engineering that leverages content rendered by the site.
For example, an external contractor with contributor-level access could insert a visually convincing login form or an iframe that loads a phishing page; site staff who view the content in the admin interface or site visitors could be tricked into entering credentials. The described CVSS impacts reflect limited confidentiality and integrity consequences rather than an automatic full site compromise.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review user roles and reduce unnecessary privileges; limit Contributor and higher roles to trusted accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase attack surface.
- Monitor site activity and content changes for unusual behavior or unexpected embedded elements.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
