Post Grid Gutenberg Blocks – PostX

ultimate-post · plugin

Known security vulnerabilities for Post Grid Gutenberg Blocks – PostX. Find out in seconds which version runs on your site with WP Lens.

20 known vulnerabilities

5 exploitable without logging in · 2 with public exploit code · latest Aug 6, 2026

Listed on wordpress.org · latest 5.0.41 · last updated Sep 16, 2026 · 30K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

CVE-2024-10728subscriber+≤ 4.1.16
PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation
High 8.8
CVE-2024-31246author+≤ 3.2.3
WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerability
High 8.8
CVE-2024-5326contributor+≤ 4.1.2
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update
High 8.8
CVE-2025-69313unauthenticated≤ 5.0.3
WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability
High 7.5
CVE-2025-12980unauthenticated≤ 5.0.3
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
High 7.5
CVE-2026-1273admin≤ 5.0.8
PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
High 7.2
CVE-2025-55707high privilege≤ 4.1.35
WordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability
High 7.2
CVE-2025-54751login required≤ 4.1.36
WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerability
High 7.1
CVE-2025-31096login required≤ 4.1.25
WordPress PostX plugin <= 4.1.25 - Cross Site Scripting (XSS) Vulnerability
Medium 6.5
CVE-2024-53818login required≤ 4.1.15
WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2024-32564login required≤ 4.0.1
WordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability
Medium 6.5
CVE-2026-5158contributor+≤ 5.0.13
PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
Medium 6.4
CVE-2026-15100contributor+≤ 5.0.32
Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
Medium 6.4
CVE-2026-13253contributor+≤ 5.0.31
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block A
Medium 6.4
CVE-2024-5223author+≤ 4.1.1
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting
Medium 6.4
CVE-2023-36385unauthenticated · needs a click≤ 2.9.9
WordPress PostX – Gutenberg Blocks for Post Grid Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)
Medium 6.1
CVE-2024-50513high privilege≤ 4.1.15
WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability
Medium 5.9
CVE-2024-50443login required≤ 4.1.12
WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability
Medium 5.4
CVE-2026-0718unauthenticated≤ 5.0.5
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification
Medium 5.3
CVE-2025-68606unauthenticated≤ 5.0.3
WordPress PostX plugin <= 5.0.3 - Sensitive Data Exposure vulnerability
Medium 5.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory