CVE-2021-24488: Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-02 · updated 2026-06-17
Weakness: CWE-79

Description

The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues

Affected products

pickplugins Post Grid: before 2.1.8 — fixed in 2.1.8

How to fix

Upgrade to a fixed version: pickplugins Post Grid 2.1.8. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/1fc0aace-ba85-4939-9007-d150960add4a
https://wpscan.com/vulnerability/1fc0aace-ba85-4939-9007-d150960add4a

Get alerted when CVE-2021-24488 or the next vulnerability affects your stack