{"id":"CVE-2021-24488","aliases":["EUVD-2021-11400","GHSA-grvg-w4gv-9v46"],"status":"published","title":"Post Grid \u003c 2.1.8 - Reflected Cross-Site Scripting (XSS)","description":"The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.11241,"percentile":0.95998,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2021-08-02T10:32:25Z","modified":"2026-06-17T03:40:07Z","exploits":[{"source":"exploitdb","id":"EDB-50705","title":"WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)","type":"webapps","platform":"php","date":"2022-02-02","url":"https://www.exploit-db.com/exploits/50705"},{"source":"nuclei","id":"CVE-2021-24488","title":"WordPress Post Grid \u003c2.1.8 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24488.yaml"}],"products":[{"vendor":"pickplugins","product":"post grid"},{"vendor":"pickplugins","product":"post_grid"},{"vendor":"unknown","product":"post grid"}],"references":[{"url":"https://wpscan.com/vulnerability/1fc0aace-ba85-4939-9007-d150960add4a","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24488"},{"url":"https://github.com/advisories/GHSA-grvg-w4gv-9v46"}],"sources":{"cve":[{"id":"CVE-2021-24488","title":"Post Grid \u003c 2.1.8 - Reflected Cross-Site Scripting (XSS)","description":"The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues","status":"published","published":"2021-08-02T10:32:25Z","modified":"2024-08-03T19:35:19.741Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:05.000797Z"}],"euvd":[{"id":"EUVD-2021-11400","description":"The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues","status":"published","published":"2021-08-02T10:32:25Z","modified":"2024-08-03T19:35:19Z","updated_at":"2026-11-03T03:24:57.403647Z"}],"ghsa":[{"id":"GHSA-grvg-w4gv-9v46","title":"The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8...","description":"The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues","status":"published","published":"2022-05-24T19:09:37Z","modified":"2023-01-30T05:01:13Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:21.550142Z"}],"nvd":[{"id":"CVE-2021-24488","description":"The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues","status":"published","published":"2021-08-02T11:15:10.843Z","modified":"2026-06-17T03:40:07.197Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:56.562207Z"}]}}