Post Grid (Pickplugins) - vulnerabilities (CVEs)
15 CVEs, 0 in the last 30 days, 224 known versions, newest CVE from 2026-09-05. Vendor: Pickplugins.
CVEs of Post Grid
- CVE-2024-11080 - CVSS 9.8 (critical), 2026-09-05: The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several…
- CVE-2024-9645 - CVSS 5.4 (medium), 2025-05-15: The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options…
- CVE-2024-13796 - CVSS 7.5 (high), 2025-02-28: The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,…
- CVE-2024-13798 - CVSS 5.3 (medium), 2025-02-22: The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including,…
- CVE-2024-13408 - CVSS 8.8 (high), 2025-01-24: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in…
- CVE-2021-4450 - CVSS 8.8 (high), 2024-10-16: The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to insufficient…
- CVE-2024-8253 - CVSS 8.8 (high), 2024-09-11: The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due to the plugin not…
- CVE-2024-7588 - CVSS 6.4 (medium), 2024-08-14: The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion block in all…
- CVE-2024-6346 - CVSS 6.4 (medium), 2024-08-01: The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL parameter of the Date…
- CVE-2024-4042 - CVSS 6.4 (medium), 2024-06-07: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site…
- CVE-2024-1988 - CVSS 6.4 (medium), 2024-06-07: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site…
- CVE-2024-3155 - CVSS 6.4 (medium), 2024-05-21: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site…
- CVE-2024-32816 - CVSS 7.5 (high), 2024-04-24: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78.
- CVE-2024-0881 - CVSS 5.4 (medium), 2024-04-11: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization,…
- CVE-2024-30441 - CVSS 7.1 (high), 2024-03-29: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid allows Reflected XSS.This issue…
- CVE-2023-7072 - CVSS 7.5 (high), 2024-03-12: The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68…
- CVE-2023-6645 - CVSS 6.4 (medium), 2024-01-11: The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up…
- CVE-2022-0447 - CVSS 6.4 (medium), 2022-04-11: The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the…
- CVE-2021-24986 - CVSS 6.1 (medium), 2022-04-11: The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected…
- CVE-2021-24488 - CVSS 6.1 (medium), 2021-08-02: The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back…
- CVE-2020-35936 - CVSS 8 (high), 2021-01-01: Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts…
- CVE-2020-35939 - CVSS 8.8 (high), 2021-01-01: PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP…
- CVE-2020-35938 - CVSS 8.8 (high), 2021-01-01: PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects…
- CVE-2020-35937 - CVSS 8 (high), 2021-01-01: Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import…
