CVE-2022-0447: Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-11 · updated 2026-06-17
Weakness: CWE-79

Description

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting

Affected products

pickplugins Post Grid: before 2.1.16 — fixed in 2.1.16

How to fix

Upgrade to a fixed version: pickplugins Post Grid 2.1.16. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/91ca2cc9-951e-4e96-96ff-3bf131209dbe
https://wpscan.com/vulnerability/91ca2cc9-951e-4e96-96ff-3bf131209dbe

Get alerted when CVE-2022-0447 or the next vulnerability affects your stack