The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions… (CVE-2026-96840)

CVE-2026-96840 describes a stored cross-site scripting vulnerability in the Post Grid Gutenberg Blocks – PostX WordPress plugin affecting all versions up to 5.1.0. The vulnerability is due to inadequate sanitization and escaping of the display_name user field. Specifically, WordPress core's pre_user_display_name filter encodes &, <, and > but does not encode double-quotes (ENT_NOQUOTES). This allows a Subscriber-level user to insert a double-quote character into their display_name via the profile page, which breaks out of the alt="" attribute in the plugin's Archive_Title.php at line 144, enabling arbitrary script injection that executes when the page is viewed.

An unauthenticated attacker with Subscriber-level access can exploit this vulnerability to inject arbitrary web scripts into pages rendered by the plugin. This can lead to client-side script execution in the context of other users viewing the affected pages, potentially resulting in session hijacking, defacement, or other malicious actions. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user permissions to prevent untrusted users from modifying the display_name field or disable the affected plugin. Monitor vendor channels for updates and apply patches promptly once released.