{"id":"CVE-2026-13253","aliases":["EUVD-2026-42520","GHSA-fmqh-3qcq-wcxg"],"status":"published","title":"Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u003c= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute","description":"The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the Advanced_Search::content() render callback: the attribute value is filtered with wp_kses(), which strips disallowed HTML tags but does NOT escape HTML special characters such as double quotes in plain text, and the result is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00357,"percentile":0.2969,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-07-09T06:52:44Z","modified":"2026-07-09T18:16:50Z","products":[{"vendor":"wpxpo","product":"post grid gutenberg blocks – postx"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/070ccd70-22c3-47f1-9dce-a884bff9ea76?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.27/blocks/Advanced_Search.php#L116"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.28/blocks/Advanced_Search.php#L116"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.28/blocks/Advanced_Search.php#L108"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.28/classes/Blocks.php#L231"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.27/blocks/Advanced_Search.php#L108"},{"url":"https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.27/classes/Blocks.php#L231"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3598669%40ultimate-post\u0026new=3598669%40ultimate-post"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13253"},{"url":"https://github.com/advisories/GHSA-fmqh-3qcq-wcxg"}],"sources":{"cve":[{"id":"CVE-2026-13253","title":"Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \u003c= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute","description":"The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the Advanced_Search::content() render callback: the attribute value is filtered with wp_kses(), which strips disallowed HTML tags but does NOT escape HTML special characters such as double quotes in plain text, and the result is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-07-09T06:52:44.934Z","modified":"2026-07-09T17:33:21.736Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-42520","description":"The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the Advanced_Search::content() render callback: the attribute value is filtered with wp_kses(), which strips disallowed HTML tags but does NOT escape HTML special characters such as double quotes in plain text, and the result is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-07-09T06:52:44Z","modified":"2026-07-09T17:33:21Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:03.742277Z"}],"ghsa":[{"id":"GHSA-fmqh-3qcq-wcxg","title":"The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ...","description":"The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the Advanced_Search::content() render callback: the attribute value is filtered with wp_kses(), which strips disallowed HTML tags but does NOT escape HTML special characters such as double quotes in plain text, and the result is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-07-09T09:30:28Z","modified":"2026-07-09T09:30:35Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:20.981798Z"}],"nvd":[{"id":"CVE-2026-13253","description":"The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the Advanced_Search::content() render callback: the attribute value is filtered with wp_kses(), which strips disallowed HTML tags but does NOT escape HTML special characters such as double quotes in plain text, and the result is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-07-09T08:16:46.403Z","modified":"2026-07-09T18:16:50.123Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:28.4135Z"}]}}