The WordPress Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks plugin contains a stored cross-site scripting flaw that permits an authenticated user with subscriber or higher privileges to inject malicious scripts into the display_name field. When a visitor selects the attacker’s author entry in an Author Filter block on a page that also has a grid or live‑filter block, the injected script runs in the victim’s browser. This flaw results from insufficient input sanitization and output escaping, enabling the attacker to compromise the confidentiality and integrity of user sessions by executing arbitrary JavaScript on the client side.

Affected plugins are Smart Post – Post Grid, Post Carousel, and Post Slider Gutenberg Blocks for Blog & News from shapedplugin. Versions up to and including 4.0.9 are impacted. These are WordPress plugins that provide grid, carousel, or slider blocks for posts.

The CVSS score of 6.4 indicates a moderate severity vulnerability. Because the EPSS score is not available, the likelihood of exploitation is unknown, but the flaw is not listed in the CISA KEV catalog. The vulnerability can be exploited by any authenticated user with subscriber-level access who can edit the display_name of an author. Once a malicious author entry is supplied, any visitor who clicks the entry in the Author Filter block will execute the injected script, giving the attacker the ability to deface the site, steal session information, or perform other client-side attacks without requiring elevated privileges or direct access to the target user’s account.