CVE-2026-96840: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpxpo Post Grid Gutenberg Blocks – PostX

CVE-2026-96840 is a stored cross-site scripting vulnerability in the Post Grid Gutenberg Blocks – PostX plugin for WordPress affecting versions up to 5.1.0. The vulnerability occurs due to improper neutralization of input in the display_name user field. WordPress core's pre_user_display_name filter encodes &, <, and > but does not encode double-quotes, allowing an attacker with Subscriber-level privileges to insert a double-quote in their display_name. This breaks out of the alt="" attribute in the plugin's Archive_Title.php at line 144, enabling injection of arbitrary web scripts that execute when a user views the injected page.

An unauthenticated attacker with Subscriber-level access can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users visiting affected pages. This can lead to information disclosure and limited integrity impacts. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, restricting Subscriber-level user capabilities and limiting untrusted user registrations may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.