The Post Grid Gutenberg Blocks – PostX plugin contains cross‑site scripting flaw that allows a user to inject arbitrary JavaScript into pages that use the Archive_Title block. The vulnerability arises from insufficient sanitization of the user’s display_name field, which can include a double quote that breaks out of an alt attribute. Once injected, any user visiting an affected page will execute the attacker’s code, potentially compromising session data, defacing content, or redirecting traffic.

WordPress installations that use the Post Grid Gutenberg Blocks – PostX plugin, including all releases up to and including version 5.1.0. Users of newer releases are not affected.

The flaw is rated CVSS 7.2, indicating a high severity impact with relatively straightforward exploitation. An attacker only needs to create or edit a subscriber account’s display_name through the WordPress admin profile page. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the injected script runs in the context of every visitor to the affected page, the threat surface is high for sites that expose the Archive_Title block publicly.