Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Post Grid, Slider & Carousel Ultimate by Unknown

    CVE-2026-16260 (GCVE-0-2026-16260)

    Vulnerability from nvd – Published: 2026-08-22 06:00 – Updated: 2026-08-22 06:00
    VLAI
    Title
    Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
    Summary
    The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/87c95831-d1b4-42… exploitvdb-entrytechnical-description
    Impacted products
    Credits
    Yaswanth Reddy Sunkara WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post Grid, Slider \u0026 Carousel Ultimate",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yaswanth Reddy Sunkara"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post Grid, Slider \u0026 Carousel Ultimate  WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T06:00:15.962Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/87c95831-d1b4-42b2-8fc7-6cba60fca400/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Post Grid, Slider \u0026 Carousel Ultimate \u003c 1.8.1 - Contributor+ Stored XSS via Header Title Field",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-16260",
    "datePublished": "2026-08-22T06:00:15.962Z",
    "dateReserved": "2026-07-20T08:30:12.390Z",
    "dateUpdated": "2026-08-22T06:00:15.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2022-1266 (GCVE-0-2022-1266)

    Vulnerability from nvd – Published: 2022-06-20 10:25 – Updated: 2024-08-02 23:55
    VLAI
    Title
    Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS
    Summary
    The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
    Severity
    No CVSS data available.
    CWE
    • CWE-79 - Cross-site Scripting (XSS)
    Assigner
    References
    Impacted products
    Vendor Product Version
    Unknown Post Grid, Slider & Carousel Ultimate Affected: 1.5.0 , < 1.5.0 (custom)
    		Create a notification for this product.
    Credits
    Fayçal CHENA
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:55:24.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/7800d583-fcfc-4360-9dc3-af3f73e12ab4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Post Grid, Slider \u0026 Carousel Ultimate",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.5.0",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Fay\u00e7al CHENA"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Post Grid, Slider \u0026 Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-20T10:25:48.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/7800d583-fcfc-4360-9dc3-af3f73e12ab4"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Post Grid, Slider \u0026 Carousel Ultimate \u003c 1.5.0 - Admin+ Stored XSS",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1266",
          "STATE": "PUBLIC",
          "TITLE": "Post Grid, Slider \u0026 Carousel Ultimate \u003c 1.5.0 - Admin+ Stored XSS"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Post Grid, Slider \u0026 Carousel Ultimate",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "1.5.0",
                            "version_value": "1.5.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Fay\u00e7al CHENA"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Post Grid, Slider \u0026 Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/7800d583-fcfc-4360-9dc3-af3f73e12ab4",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/7800d583-fcfc-4360-9dc3-af3f73e12ab4"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1266",
    "datePublished": "2022-06-20T10:25:48.000Z",
    "dateReserved": "2022-04-07T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:55:24.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}