{"id":"CVE-2026-56056","kind":"vulnerability","aliases":["CVE-2026-56056"],"related":[],"title":"The Post Grid WordPress plugin: stored XSS through version 7.9.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.","summary":"The Post Grid, a WordPress plugin by Mamunur Rashid, fails to neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can store content on the site can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","the-post-grid","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of The Post Grid (`the-post-grid`) in the WordPress plugins screen or its plugin header.","fix":"- The Post Grid (`the-post-grid`): move to a version later than `7.9.7`; the exact fixed version is unknown.","status":"open","published_at":"2026-10-29T13:17:13+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","triaged_at":"2026-10-29T13:25:34+00:00","updated_at":"2026-10-29T13:25:34+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-29T13:25:34Z","model":"claude-haiku-5-5","output":{"fix":"- The Post Grid (`the-post-grid`): move to a version later than `7.9.7`; the exact fixed version is unknown.","reach":"internet","title":"The Post Grid WordPress plugin: stored XSS through version 7.9.7","impact":"medium","summary":"The Post Grid, a WordPress plugin by Mamunur Rashid, fails to neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can store content on the site can run scripts in other visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","the-post-grid","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers on the affected site","analyst_note":"Confirm the first fixed version and the privilege level needed to store the payload, via https://nvd.nist.gov/vuln/detail/CVE-2026-56056 or the plugin's changelog.","how_to_check":"- Check the installed version of The Post Grid (`the-post-grid`) in the WordPress plugins screen or its plugin header.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running The Post Grid WordPress plugin version 7.9.7 or earlier are affected. The sources do not say which roles can store the input, so whether an attacker needs an account is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":4126,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-56056':13A,16A '7.9.7':10A,98C 'affect':91C 'allow':42B,87C 'attack':49B 'browser':63B 'content':53B 'cross':45B,73C 'cross-sit':44B,72C 'cve':11A,14A 'fail':35B 'generat':40B,71C 'grid':3A,24B,28B,82C,86C,94C 'host':20B 'improp':64C 'input':38B,67C 'issu':90C 'mamunur':33B,78C 'n/a':96C 'neutral':37B,65C 'page':41B,70C 'plugin':5A,31B 'post':2A,23B,27B,81C,85C,93C 'rashid':34B,79C 'run':58B 'script':47B,59B,75C 'self':19B 'self-host':18B 'site':46B,56B,74C 'store':6A,43B,52B,88C 'the-post-grid':21B,83C 'version':9A 'visitor':62B 'vulner':76C 'web':69C 'wordpress':4A,25B,30B 'xss':7A 'xss.this':89C","nicknames":[],"mitigations":[],"who_affected":"Sites running The Post Grid WordPress plugin version 7.9.7 or earlier are affected. The sources do not say which roles can store the input, so whether an attacker needs an account is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56056","severity":null,"published_at":"2026-10-29T13:17:13+00:00","modified_at":"2026-10-29T13:17:13+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","fetched_at":"2026-10-29T13:25:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}