The Post Grid Master plugin processes the argsArray['read_more_text'] parameter without proper sanitization or escaping, allowing an unauthenticated attacker to inject malicious JavaScript that is reflected back into the page. When the victim visits the crafted URL, the injected code executes in the context of the target site, enabling credential theft, session hijacking, defacement, or other client‑side attacks. This vulnerability is a classic instance of CWE‑79, a reflected XSS weakness.

The weakness affects the WordPress plugin "Post Grid Master" supplied by mdshuvo. All releases up to and including version 3.4.13 are vulnerable. No fixed version is specified in the CVE payload, so the status of newer releases remains unknown.

With a CVSS base score of 6.1, the flaw is considered moderate severity. The EPSS score of less than 1% indicates a low likelihood that attackers are actively exploiting it, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a reflected XSS that requires an end‑user to interact with a malicious link or page, so the threat is limited to users visiting a compromised or crafted URL.