The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This occurs in the file uploading feature, allowing authenticated users with Author-level privileges or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability impacts all plugin versions up to and including 4.1.1. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the Author level.

An attacker with Author-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to unauthorized actions such as session hijacking or defacement. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access, which reduces the attack surface compared to unauthenticated vulnerabilities.

Patch status is not yet confirmed—no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any released patches promptly. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or limiting the use of the file uploading feature in the plugin to reduce risk.