CVE-2024-4042

The Post Grid plugin for WordPress before version 2.2.81 contains a stored cross-site scripting vulnerability in the menu-wrap-item block's class attribute due to inadequate sanitization and escaping of user input. Attackers with contributor-level permissions or higher can inject malicious scripts into pages that execute when other users view the affected content. The vulnerability allows authenticated users to store arbitrary code that persists and runs in the browsers of site visitors.

Based on public CVE data (MITRE/NVD).