The vulnerability in the Ultimate Post plugin for WordPress (Post Grid Gutenberg Blocks – PostX) is due to insufficient input sanitization and output escaping in the Advanced_Search::content() render callback. The 'moreResultsText' attribute is filtered using wp_kses(), which removes disallowed HTML tags but does not escape HTML special characters such as double quotes. The filtered value is then concatenated directly into the data-viewmoretext HTML attribute without using esc_attr(), enabling stored cross-site scripting. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute when users view the injected page. No official patch or remediation level has been provided as of the published date.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable 'moreResultsText' attribute. These scripts execute in the context of users visiting the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity of user interactions on affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable block if feasible. Monitor vendor channels for updates and apply patches promptly once available.