{"id":"CVE-2026-119160","kind":"vulnerability","aliases":["CVE-2026-119160"],"related":[],"title":"WordPress Smart Post plugin: stored cross-site scripting via display_name parameter","description":"The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown — a standard filter interaction requiring no elevated privileges from the victim.","summary":"The Smart Post Gutenberg blocks plugin for WordPress does not sanitize the display_name parameter, letting a subscriber-level user store scripts. When a visitor clicks the attacker's entry in an Author Filter dropdown on a page with those blocks, the script runs in their browser.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","smart-post","wordpress"],"not_affected_if":["auth-required","no-author-filter-block","plugin-not-installed"],"how_to_check":"- Check whether the Smart Post plugin (Post Grid, Post Carousel, Post Slider blocks) is installed and its version, in the WordPress admin under Plugins.\n- Look for pages that use an Author Filter block alongside a grid or live-filter block.","fix":"- Smart Post plugin: versions up to and including `4.0.9` are affected; the sources do not state a fixed version.","status":"open","published_at":"2026-10-31T09:16:33+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","triaged_at":"2026-10-31T09:35:46+00:00","updated_at":"2026-10-31T09:35:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T09:35:46Z","model":"claude-haiku-5-5","output":{"fix":"- Smart Post plugin: versions up to and including `4.0.9` are affected; the sources do not state a fixed version.","reach":"internet","title":"WordPress Smart Post plugin: stored cross-site scripting via display_name parameter","impact":"medium","summary":"The Smart Post Gutenberg blocks plugin for WordPress does not sanitize the display_name parameter, letting a subscriber-level user store scripts. When a visitor clicks the attacker's entry in an Author Filter dropdown on a page with those blocks, the script runs in their browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","smart-post","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Visitor's browser runs attacker scripts on pages showing the filter","analyst_note":"Confirm the fixed version of Smart Post after 4.0.9 from the plugin's WordPress.org changelog or NVD entry.","how_to_check":"- Check whether the Smart Post plugin (Post Grid, Post Carousel, Post Slider blocks) is installed and its version, in the WordPress admin under Plugins.\n- Look for pages that use an Author Filter block alongside a grid or live-filter block.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-author-filter-block","auth-required"],"who_is_affected":"Sites running the Smart Post plugin version 4.0.9 or earlier that have an Author Filter block on a page with a grid or live-filter block. Attackers need a subscriber-level account on the site, and visitors must click the injected author entry. Sites without the plugin or without those blocks are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4298,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119160':16A,19A '-2026':15A,18A '4.0.9':113C 'access':133C,149C 'alongsid':164C 'arbitrari':138C 'attack':56B,128C,181C 'authent':127C 'author':61B,161C,183C 'block':32B,69B,86C,163C,171C 'blog':88C 'browser':75B 'carousel':82C 'click':54B,179C 'contain':159C 'cross':7A,98C 'cross-sit':6A,97C 'cve':14A,17A 'display':11A,40B,103C 'dropdown':63B,187C 'due':114C 'elev':194C 'entri':58B,184C 'escap':121C 'execut':145C,173C 'exploit':153C 'filter':62B,162C,170C,190C 'grid':80C,166C 'gutenberg':31B,85C 'host':23B 'includ':112C 'inject':137C,151C 'input':117C 'insuffici':116C 'interact':191C 'let':43B 'level':47B,132C 'live':169C 'live-filt':168C 'make':123C 'name':12A,41B,104C 'news':89C 'output':120C 'packag':20B 'page':66B,142C,152C,157C 'paramet':13A,42B,105C 'plugin':4A,33B,90C 'possibl':125C 'post':3A,26B,30B,78C,79C,81C,83C 'privileg':195C 'requir':154C,192C 'run':72B 'sanit':38B,118C 'script':9A,50B,71B,100C,140C 'self':22B 'self-host':21B 'site':8A,99C 'slider':84C 'smart':2A,25B,29B,77C 'smart-post':24B 'standard':189C 'store':5A,49B,96C 'subscrib':46B,131C 'subscriber-level':45B,130C 'trigger':175C 'user':48B,148C 'version':108C 'via':10A,101C 'victim':156C,198C 'visitor':53B,178C 'vulner':94C 'web':139C 'whenev':146C 'wordpress':1A,27B,35B,92C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Smart Post plugin version 4.0.9 or earlier that have an Author Filter block on a page with a grid or live-filter block. Attackers need a subscriber-level account on the site, and visitors must click the injected author entry. Sites without the plugin or without those blocks are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T09:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119160","severity":null,"published_at":"2026-10-31T09:16:33+00:00","modified_at":"2026-10-31T09:16:33+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","fetched_at":"2026-10-31T09:34:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}