WP Clinic
Entrar Registrarse

Recursos / Plugins de WordPress / Post Grid

SEGURIDAD DE PLUGINS

¿Es seguro Post Grid?

Vulnerabilidades conocidas, compatibilidad con PHP y alternativas más seguras para el plugin de WordPress Post Grid — verificado contra la base de datos de seguridad local de WP Clinic.

Qué hace este plugin

  • Slug: post-grid

Estado de mantenimiento

  • Última versión conocida: 2.3.24

Vulnerabilidades conocidas

29 CVEs conocidos registrados para Post Grid.

CVE Vulnerabilidad Tipo Gravedad Afectadas Corregido en Publicado Estado
— Post Grid [post-grid] <= 2.3.23 (unfixed) Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,5 < 2.3.23 2.3.23 2025-12-21 ✓ corregido en la última versión
— Post Grid [post-grid] <= 2.3.23 (unfixed) Elusión de autorización mediante una clave controlada por el usuario Desconocido < 2.3.23 2.3.23 2025-12-03 ✓ corregido en la última versión
CVE-2025-62924 Post Grid [post-grid] < 2.3.18 Falta de control de autorización Alta 8,8 < 2.3.18 2.3.18 2025-10-04 ✓ corregido en la última versión
CVE-2025-66058 Post Grid [post-grid] < 2.3.18 Falta de control de autorización Desconocido < 2.3.18 2.3.18 2025-10-04 ✓ corregido en la última versión
CVE-2025-54007 Post Grid [post-grid] < 2.3.12 Deserialización de datos no confiables Alta 8,8 < 2.3.12 2.3.12 2025-08-06 ✓ corregido en la última versión
CVE-2024-13796 Post Grid [post-grid] < 2.3.7 Exposición de información sensible a un actor no autorizado Media 5,3 < 2.3.7 2.3.7 2025-02-27 ✓ corregido en la última versión
CVE-2024-13798 Post Grid [post-grid] < 2.3.6 Validación incorrecta de la entrada Media 5,3 < 2.3.6 2.3.6 2025-02-21 ✓ corregido en la última versión
CVE-2024-50432 Post Grid [post-grid] < 2.2.94 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,5 < 2.2.94 2.2.94 2024-10-24 ✓ corregido en la última versión

Post Grid [post-grid] <= 2.3.23 (unfixed)

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Post Grid [post-grid] <= 2.3.23 (unfixed)

Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-62924

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.17. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-66058

The Post Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-54007

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3.11 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-13796

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.6 via the /wp-json/post-grid/v2/get_users REST API This makes it possible for unauthenticated attackers to extract sensitive data including including emails and other user data.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-13798

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create new orders for products and mark them as paid without actually completing a payment.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-50432

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.93 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 32 vulnerabilidades conocidas más
CVE Vulnerabilidad Tipo Gravedad Afectadas Corregido en Publicado Estado
CVE-2021-4450 Post Grid [post-grid] < 2.1.13 Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) Alta 8,8 < 2.1.13 2.1.13 2024-10-16 ✓ corregido en la última versión
CVE-2024-47340 Post Grid [post-grid] < 2.2.90 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,5 < 2.2.90 2.2.90 2024-09-27 ✓ corregido en la última versión
CVE-2024-8253 Post Grid [post-grid] < 2.2.91 Asignación incorrecta de privilegios Alta 8,8 < 2.2.91 2.2.91 2024-09-10 ✓ corregido en la última versión
CVE-2024-7588 Post Grid [post-grid] < 2.2.88 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,4 < 2.2.88 2.2.88 2024-08-13 ✓ corregido en la última versión
CVE-2024-43155 Post Grid [post-grid] < 2.2.87 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,5 < 2.2.87 2.2.87 2024-08-07 ✓ corregido en la última versión
CVE-2024-6346 Post Grid [post-grid] < 2.2.86 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 5,4 < 2.2.86 2.2.86 2024-07-31 ✓ corregido en la última versión
CVE-2024-4042 Post Grid [post-grid] < 2.2.81 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 5,4 < 2.2.81 2.2.81 2024-06-06 ✓ corregido en la última versión
CVE-2024-1988 Post Grid [post-grid] < 2.2.81 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 5,4 < 2.2.81 2.2.81 2024-06-06 ✓ corregido en la última versión
CVE-2024-3155 Post Grid [post-grid] < 2.2.81 Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico) Media 6,4 < 2.2.81 2.2.81 2024-05-20 ✓ corregido en la última versión
CVE-2024-32816 Post Grid [post-grid] < 2.2.79 Exposición de información sensible a un actor no autorizado Alta 7,5 < 2.2.79 2.2.79 2024-04-22 ✓ corregido en la última versión
CVE-2024-30441 Post Grid [post-grid] < 2.2.76 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 7,1 < 2.2.76 2.2.76 2024-03-28 ✓ corregido en la última versión
CVE-2024-0881 Post Grid [post-grid] < 2.2.76 Autorización incorrecta Media 5,4 < 2.2.76 2.2.76 2024-03-19 ✓ corregido en la última versión
CVE-2023-7072 Post Grid [post-grid] < 2.2.69 Exposición de información sensible a través de consultas de datos Alta 7,5 < 2.2.69 2.2.69 2024-03-12 ✓ corregido en la última versión
CVE-2023-6645 Post Grid [post-grid] < 2.2.65 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 5,4 < 2.2.65 2.2.65 2023-12-15 ✓ corregido en la última versión
CVE-2023-40211 Post Grid [post-grid] < 2.2.51 Exposición de información sensible a un actor no autorizado Alta 7,5 < 2.2.51 2.2.51 2023-08-11 ✓ corregido en la última versión
CVE-2022-0447 Post Grid [post-grid] < 2.1.16 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,4 < 2.1.16 2.1.16 2022-03-15 ✓ corregido en la última versión
CVE-2021-24986 Post Grid [post-grid] < 2.1.16 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,1 < 2.1.16 2.1.16 2022-03-15 ✓ corregido en la última versión
— Post Grid [post-grid] < 2.1.13 — Desconocido < 2.1.13 2.1.13 2021-12-15 ✓ corregido en la última versión
CVE-2021-24488 Post Grid [post-grid] < 2.1.8 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 6,1 < 2.1.8 2.1.8 2021-06-28 ✓ corregido en la última versión
CVE-2020-35938 Post Grid [post-grid] < 2.0.73 Deserialización de datos no confiables Alta 8,8 < 2.0.73 2.0.73 2021-01-01 ✓ corregido en la última versión
CVE-2020-35936 Post Grid [post-grid] < 2.0.73 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 8,0 < 2.0.73 2.0.73 2021-01-01 ✓ corregido en la última versión
CVE-2020-35937 Post Grid [post-grid] < 2.0.73 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Alta 8,0 < 2.0.73 2.0.73 2021-01-01 ✓ corregido en la última versión
CVE-2020-35939 Post Grid [post-grid] < 2.0.73 Deserialización de datos no confiables Alta 8,8 < 2.0.73 2.0.73 2021-01-01 ✓ corregido en la última versión
— Post Grid [post-grid] < 2.0.73 — Desconocido < 2.0.73 2.0.73 2020-10-05 ✓ corregido en la última versión
— Post Grid [post-grid] < 2.0.73 — Desconocido < 2.0.73 2.0.73 2020-10-05 ✓ corregido en la última versión
— Post Grid [post-grid] < 2.0.13 — Desconocido < 2.0.13 2.0.13 2016-11-08 ✓ corregido en la última versión
— Post Grid [post-grid] < 2.0.13 — Desconocido < 2.0.13 2.0.13 2016-11-08 ✓ corregido en la última versión
— Post Grid [post-grid] < 2.0.13 — Desconocido < 2.0.13 2.0.13 2016-11-08 ✓ corregido en la última versión
CVE-2024-9636 Post Grid [post-grid] >= 2.2.85 - < 2.3.4 Gestión incorrecta de privilegios Crítica 9,8 2.2.85–2.3.4 2.3.4 0000-00-00 ✓ corregido en la última versión
— Post Grid [post-grid] < 2.2.93 Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) Media 5,4 < 2.2.93 2.2.93 0000-00-00 ✓ corregido en la última versión
— Post Grid [post-grid] < 2.1.13 — Desconocido < 2.1.13 2.1.13 — ✓ corregido en la última versión
— Post Grid [post-grid] < 2.0.13 — Desconocido < 2.0.13 2.0.13 — ✓ corregido en la última versión

CVE-2021-4450

The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-47340

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-8253

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not properly restricting what user meta values can be updated and ensuring a form is active. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta to become an administrator.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-7588

The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion block in all versions up to, and including, 2.2.87 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-43155

The ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several blocks in versions up to, and including, 2.2.86 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-6346

The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL parameter of the Date Countdown widget, in all versions up to, and including, 2.2.85a due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4042

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the menu-wrap-item block in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1988

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute in blocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3155

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-32816

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.78. This makes it possible for unauthenticated attackers to extract sensitive information.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-30441

Update the WordPress Post Grid plugin to the latest available version (at least 2.2.76). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Post Grid Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.2.76. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-0881

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.74 via the post_grid_paginate_ajax_free AJAX endpoint. This makes it possible for unauthenticated attackers to retrieve private and password protected posts that may contain sensitive information.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-7072

The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'get_posts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including full draft posts and password protected posts, as well as the password for password-protected posts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-6645

Update the WordPress Post Grid plugin to the latest available version (at least 2.2.65). Rafshanzani Suhada discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Post Grid Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.2.65. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-40211

The Post Grid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in versions up to, and including, 2.2.50. This makes it possible for unauthenticated attackers to expose sensitive inforamtion.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-0447

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-24986

The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Post Grid [post-grid] < 2.1.13

The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-24488

The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2020-35938

PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2020-35936

Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2020-35937

Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2020-35939

PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Post Grid [post-grid] < 2.0.73

PHP Object Injection vulnerability found by Ramuel Gall (Wordfence) in WordPress Post Grid plugin (versions <= 2.0.72).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Post Grid [post-grid] < 2.0.73

Authenticated Stored Cross-Site Scripting (XSS) vulnerability found by Ramuel Gall in WordPress Post Grid plugin (versions <= 2.0.72).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Post Grid [post-grid] < 2.0.13

This plugin is prone to an arbitrary file deletion vulnerability. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Post Grid [post-grid] < 2.0.13

WordPress Post Grid plugin File deletion vulnerability allows any user to delete any file from the website. The vulnerbility is in post_grid_ajax_remove_export_content_layout() function. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Post Grid [post-grid] < 2.0.13

The Post Grid plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.0.12. This is due to the plugin failing to properly verify user input. This makes it possible for unauthenticated attackers to delete files on the vulnerable service.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-9636

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Post Grid [post-grid] < 2.2.93

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.92 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Post Grid [post-grid] < 2.1.13

The plugin does not sanitise and escape user input before using it in a SQL statement when duplicating posts (available to Contributor+ users), leading to an SQL Injection

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Post Grid [post-grid] < 2.0.13

The Post Grid WordPress plugin was affected by an Unauthenticated Arbitrary File Deletion security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Post Grid actualizado — 2.3.24 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Verifica tu propio sitio WordPress

Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.

Ejecutar un escaneo gratis Obtener el plugin (gratis)