What’s Vulnerable › Products

WPXPO PostX vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your WPXPO PostX version is affected

Latest WPXPO PostX vulnerabilities

• CVE-2026-0718 — Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification (CVSS 5.3)
• CVE-2026-1273 — PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints (CVSS 7.2)
• CVE-2025-69313 — WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2025-68606 — WordPress PostX plugin <= 5.0.3 - Sensitive Data Exposure vulnerability (CVSS 5.3)
• CVE-2025-12980 — Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 7.5)
• CVE-2025-55707 — WordPress PostX Plugin <= 4.1.35 - Privilege Escalation Vulnerability (CVSS 7.2)
• CVE-2025-54751 — WordPress PostX plugin <= 4.1.36 - Broken Access Control vulnerability (CVSS 7.1)
• CVE-2025-31096 — WordPress PostX plugin <= 4.1.25 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
• CVE-2024-53818 — WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2024-50513 — WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
• CVE-2024-10728 — PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation (CVSS 8.8)
• CVE-2024-50443 — WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
• CVE-2024-4305 — PostX < 4.1.0 - Contributor+ Stored XSS (CVSS 6.8)
• CVE-2024-31246 — WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerability (CVSS 8.8)
• CVE-2024-5326 — Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update (CVSS 8.8)
• CVE-2024-5223 — Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
• CVE-2024-3239 — PostX < 4.0.2 - Contributor+ Stored XSS (CVSS 5.4)
• CVE-2023-3992 — PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting (CVSS 6.1)
• CVE-2023-36385 — WordPress PostX – Gutenberg Blocks for Post Grid Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)