CVE-2026-84151 — LOW (3.5) — White Hats Nepal

Vulnerability Description

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.

CVSS Score

3.5

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/6601a305-a76f-40fe-8d78-c6a33a66d5f3/

FAQ

What is CVE-2026-84151?

CVE-2026-84151 is a vulnerability with a CVSS score of 3.5 (LOW). The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and abo...

How severe is CVE-2026-84151?

CVE-2026-84151 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-84151?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.