The Post Grid plugin for WordPress, versions up to 2.2.80, contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'class' attribute of the menu-wrap-item block. This allows authenticated users with contributor-level permissions or above to inject arbitrary web scripts that execute in the context of other users viewing the injected pages. The vulnerability is network exploitable with low attack complexity and does not require user interaction. It impacts confidentiality and integrity but not availability, reflected in a CVSS 3.1 score of 6.4.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who access the compromised pages, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of the victim. The vulnerability affects confidentiality and integrity but does not impact system availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Post Grid plugin if possible. Monitor for updates from pickplugins regarding a security patch and apply it promptly once released.