Post Grid Gutenberg Blocks – PostX

Post Grid Gutenberg Blocks – PostX has 29 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 29 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 7 high. 2024 was the busiest year with 10 disclosures.

The most common weakness is Cross-Site Scripting, behind 16 of the records (55%). Other recurring categories include Missing Authorization, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 29 issues recorded for Post Grid Gutenberg Blocks – PostX has a vendor fix available, so running the current release closes all known holes.

22 independent researchers contributed these findings, most of them (4) reported by apple502j.

01234567891017.08.2021Today17.08.20216.5PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Unauthorized Access Controls CVSS 6.5 · 17.08.202126.08.20214.3PostX Gutenberg Blocks Saved Templates Addon <= 2.4.9 - Private Content Disclosure CVSS 4.3 · 26.08.20215.4PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Stored Cross-Site Scripting CVSS 5.4 · 26.08.20215.4PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 5.4 · 26.08.202123.06.20237.2PostX – Gutenberg Blocks for Post Grid <= 2.9.9 - Unauthenticated Cross-Site Scripting CVSS 7.2 · 23.06.202302.08.20236.1PostX - Gutenberg Post Grid Blocks <= 3.0.5 - Reflected Cross-Site Scripting via 'postx_type' CVSS 6.1 · 02.08.202305.04.20244.3PostX – Gutenberg Blocks for Post Grid <= 3.2.3 - Incorrect Authorization CVSS 4.3 · 05.04.202416.04.20246.4Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.04.202422.04.20246.4Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 22.04.202427.05.20246.4Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.4 - Authenticated (Contributor+) Stored Cross=Site Scripting CVSS 6.4 · 27.05.202429.05.20248.8Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update CVSS 8.8 · 29.05.20246.4Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 29.05.202424.10.20246.4PostX <= 4.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 24.10.202428.10.20246.4PostX <= 4.1.15 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 28.10.202415.11.20248.8PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation CVSS 8.8 · 15.11.202402.12.20246.4PostX <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 02.12.202428.03.20256.4PostX <= 4.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 28.03.202529.08.20257.2PostX <= 4.1.35 - Authenticated (Editor+) Privilege Escalation CVSS 7.2 · 29.08.202502.09.20254.3PostX <= 4.1.36 - Missing Authorization CVSS 4.3 · 02.09.202520.12.20257.5Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVSS 7.5 · 20.12.202521.12.20255.3PostX <= 5.0.3 - Unauthenticated Information Exposure CVSS 5.3 · 21.12.202519.01.20265.3PostX <= 5.0.3 - Missing Authorization CVSS 5.3 · 19.01.202603.03.20267.2PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints CVSS 7.2 · 03.03.202615.04.20265.3Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification CVSS 5.3 · 15.04.202608.07.20266.4Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute CVSS 6.4 · 08.07.202623.07.20266.4Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute CVSS 6.4 · 23.07.202605.08.20266.4PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block CVSS 6.4 · 05.08.202621.09.20265.3PostX <= 5.0.40 - Unauthenticated Information Exposure CVSS 5.3 · 21.09.202609.10.20267.2Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field CVSS 7.2 · 09.10.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

29

Get automatic notifications for all Post Grid Gutenberg Blocks – PostX vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-10728

PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation

Read the full analysis

Vulnerability Records

29 records
2026-10-09 17:44
Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
Post Grid Gutenberg Blocks
<= 5.1.0
CVE-2026-96840
7.2
High
Jacek Sowiński (dzaku)Yes
2026-09-21 00:00
PostX <= 5.0.40 - Unauthenticated Information Exposure
Post Grid Gutenberg Blocks
<= 5.0.40
CVE-2026-86783
5.3
Medium
Pedro PinhoYes
2026-08-05 22:05
PostX <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block
Post Grid Gutenberg Blocks
<= 5.0.13
CVE-2026-5158
6.4
Medium
Muhammad Yudha - DJYes
2026-07-23 14:31
Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
Post Grid Gutenberg Blocks
<= 5.0.32
CVE-2026-15100
6.4
Medium
Wordfence PRISMYes
2026-07-08 18:16
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute
Post Grid Gutenberg Blocks
<= 5.0.31
CVE-2026-13253
6.4
Medium
Wordfence PRISMYes
2026-04-15 18:53
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification
Post Grid Gutenberg Blocks
<= 5.0.5
CVE-2026-0718
5.3
Medium
Mohammad Amin Hajian (mamadrce)Yes
2026-03-03 12:22
PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints
Post Grid Gutenberg Blocks
<= 5.0.8
CVE-2026-1273
7.2
High
Mohammad Amin Hajian (mamadrce)Yes
2026-01-19 00:00
PostX <= 5.0.3 - Missing Authorization
Post Grid Gutenberg Blocks
<= 5.0.3
CVE-2025-69313
5.3
Medium
MD ISMAILYes
2025-12-21 00:00
PostX <= 5.0.3 - Unauthenticated Information Exposure
Post Grid Gutenberg Blocks
<= 5.0.3
CVE-2025-68606
5.3
Medium
Doan Dinh Van (d52v)Yes
2025-12-20 14:15
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Post Grid Gutenberg Blocks
<= 5.0.3
CVE-2025-12980
7.5
High
Marcin Dudek (dudekmar)Yes
Showing 1–10 of 29 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C