CVE-2026-15100

Name of the Vulnerable Software and Affected Versions Post Grid Gutenberg Blocks – PostX versions prior to 5.0.33

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. This issue is critical in cross-privilege scenarios where a contributor creates a pending or draft post containing a malicious searchnoresult block attribute, which then executes arbitrary JavaScript in the browser session of an editor or administrator who previews the post.

Recommendations Update to a version newer than 5.0.32. Restrict the use of the searchnoresult block attribute for users with contributor-level access until the update is applied.