The Cinza Grid plugin contains a stored XSS flaw that allows an authenticated user with contributor or higher privileges to insert malicious scripts into the cgrid_skin_content post meta field. When a page incorporating that skin is rendered, the injected script runs in the victim’s browser, enabling session hijacking, credential theft, or other client‑side attacks. The vulnerability is limited to data entered through the skin content field and does not provide code execution on the server.

WordPress sites using the Cinza Grid plugin, vendor madebycinza, from the first release up to and including version 1.2.1.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1%, suggesting a very low likelihood of exploitation. It is not listed in CISA’s KEV catalog. Attackers need only authenticated contributor‑level access, which is common in many WordPress deployments. Once the script is embedded, it will execute for any user who views the affected page, creating a broad impact scope for those with higher privileges.