The pickplugins Post Grid WordPress plugin is vulnerable to stored XSS via the redirectURL parameter of the Date Countdown widget. This occurs because user-supplied input is not properly sanitized or escaped before being output in web pages. An attacker with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 2.2.85. No official patch or fix information is provided in the available data.

Successful exploitation allows an authenticated attacker with contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and has limited impact on confidentiality and integrity as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable Date Countdown widget. Monitor vendor channels for updates and apply patches promptly once released.