WordPress post-grid has 18 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-0881 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper | medium | 5.4 | <2.2.76 | 2.2.76 |
| CVE-2021-24488 | The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before | medium | 6.1 | <2.1.8 | 2.1.8 |
| CVE-2024-8253 | The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in all versions 2.2.87 to 2.2.90. This is due | high | 8.8 | >=2.2.87 and <2.2.91 | 2.2.91 |
| CVE-2020-35938 | PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbi | high | 7.5 | <2.0.73 | 2.0.73 |
| CVE-2020-35939 | PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject | high | 7.5 | <2.0.73 | 2.0.73 |
| CVE-2020-35936 | Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers t | high | 7.5 | <2.0.73 | 2.0.73 |
| CVE-2020-35937 | Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attack | high | 7.5 | <2.0.73 | 2.0.73 |
| CVE-2021-24986 | The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a R | medium | 6.1 | <2.1.16 | 2.1.16 |
| CVE-2022-0447 | The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response | medium | 6.4 | <2.1.16 | 2.1.16 |
| CVE-2023-7072 | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i | high | 7.5 | <2.2.69 | 2.2.69 |
| CVE-2021-4450 | The Post Grid plugin for WordPress is vulnerable to blind SQL Injection via post metadata in versions up to, and including, 2.1.12 due to in | high | 8.8 | <=2.1.12 | – |
| CVE-2024-13796 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, | medium | 5.3 | <2.3.7 | 2.3.7 |
| CVE-2023-6645 | The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in | medium | 6.4 | <=2.2.64 | – |
| CVE-2024-13798 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, an | medium | 5.3 | <2.3.6 | 2.3.6 |
| CVE-2024-6346 | The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL param | medium | 6.4 | <2.2.86 | 2.2.86 |
| CVE-2024-9645 | The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of i | medium | 5.4 | <2.2.93 | 2.2.93 |
| CVE-2024-1988 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to | medium | 6.4 | <2.2.81 | 2.2.81 |
| CVE-2024-4042 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to | medium | 6.4 | <2.2.81 | 2.2.81 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked