CVE-2026-84151

Name of the Vulnerable Software and Affected Versions The Post Grid versions prior to 7.9.5

Description The plugin fails to limit the expansion of the WordPress allowed-HTML list to its own markup, applying the change site-wide. This allows users with the Contributor role and above to store iframe, style, and input elements that are typically stripped from content. This leads to stored HTML injection, which can be used for phishing frames, CSS defacement, and spoofed input forms that are rendered to all visitors and administrators reviewing the content.

Recommendations Update The Post Grid to version 7.9.5 or later.