CVE-2026-96840

HighCVSS 7.2/10Last modified Oct 13, 2026

Description

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's pre_user_display_name filter encodes &, <, and > but leaves double-quotes intact (ENT_NOQUOTES), allowing a Subscriber-level user to store a double-quote in their display_name via /wp-admin/profile.php that subsequently breaks out of the alt="" attribute at Archive_Title.php:144.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 10, 2026
Last modified
Oct 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-968437.8Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally.CVE-2026-968448.0Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent neCVE-2026-968465.5Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally.CVE-2026-968477.8Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.CVE-2026-968485.5Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.CVE-2026-968495.5Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally.CVE-2026-968505.5Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.CVE-2026-968515.5Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.CVE-2026-968527.0Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.CVE-2026-968534.7Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information loCVE-2026-968545.5Access of resource using incompatible type ('type confusion') in Windows Device Association Service allows an authorized attacker to disclosCVE-2026-968555.5Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
CVE-2026-96840: High severity, CVSS 7.2 | Vulnix