Post Grid
post-grid · plugin
Known security vulnerabilities for Post Grid. Find out in seconds which version runs on your site with WP Lens.
23 known vulnerabilities
2 critical · 9 exploitable without logging in · 1 with public exploit code · latest Sep 5, 2026
Listed on wordpress.org · latest 2.3.24 · last updated Jul 19, 2026 · 30K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 9.8
CVE-2024-11080unauthenticated≤ 2.3.32
Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection
- Critical 9.8
CVE-2024-9636unauthenticated≤ 2.3.3
Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation
- High 8.8
CVE-2025-54007login required≤ 2.3.11
WordPress Post Grid and Gutenberg Blocks Plugin <= 2.3.11 - PHP Object Injection Vulnerability
- High 8.8
CVE-2024-8253subscriber+≤ 2.2.90
Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation
- High 7.5
CVE-2024-13796unauthenticated≤ 2.3.6
Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure
- High 7.5
CVE-2024-32816unauthenticated≤ 2.2.78
WordPress Combo Blocks plugin <= 2.2.78 - Sensitive Data Exposure via API vulnerability
- High 7.5
CVE-2023-7072unauthenticated≤ 2.2.68
Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint
- High 7.5
CVE-2023-40211unauthenticated≤ 2.2.50
WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure
- High 7.1
CVE-2024-30441unauthenticated · needs a click≤ 2.2.74
WordPress Combo Blocks plugin <= 2.2.74 - Reflected Cross Site Scripting (XSS) vulnerability
- Medium 6.5
CVE-2025-68605login required≤ 2.3.23
WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Cross Site Scripting (XSS) vulnerability
- Medium 6.5
CVE-2025-66058login required≤ 2.3.17
WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability
- Medium 6.5
CVE-2025-62924login required≤ 2.3.17
WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability
- Medium 6.5
CVE-2024-50432login required≤ 2.2.93
WordPress Post Grid and Gutenberg Blocks plugin <= 2.2.93 - Cross Site Scripting (XSS) vulnerability
- Medium 6.5
CVE-2024-47340login required≤ 2.2.89
WordPress ComboBlocks plugin <= 2.2.89 - Cross Site Scripting (XSS) vulnerability
- Medium 6.5
CVE-2024-43155login required≤ 2.2.86
WordPress ComboBlocks plugin <= 2.2.86 - Cross Site Scripting (XSS) vulnerability
- Medium 6.4
CVE-2024-7588contributor+≤ 2.2.84
Gutenberg Blocks, Page Builder – ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block
- Medium 6.4
CVE-2024-3155contributor+≤ 2.2.80
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scr
- Medium 5.4
CVE-2024-6346contributor+≤ 2.2.85
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scr
- Medium 5.4
CVE-2024-4042contributor+≤ 2.2.80
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scr
- Medium 5.4
CVE-2024-1988contributor+≤ 2.2.80
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scr
- Medium 5.4
CVE-2023-6645contributor+≤ 2.2.64
Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting
- Medium 5.3
CVE-2025-63043unauthenticated≤ 2.3.23
WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability
- Medium 5.3
CVE-2024-13798unauthenticated≤ 2.3.5
Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).