Skip to content
Sign in
Not rated

CVE-2022-0447 The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting…

Description

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting

Affected products and versions

Product Affected versions Fixed in
Post Grid 2.1 earliest → < 2.1.16 2.1.16

Other CVEs of Post Grid

The 3 CVEs of Post Grid →
CVE-2021-24986 The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an… Not rated CVE-2021-24488 The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not… Not rated
Track this CVE