cleantalk
Vulnerabilities and Security Researches

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks, CVE-2023-6645

CVE, Research URL

CVE-2023-6645

Home page URL

Security reports for Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks

Application

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks

Published on
Jan 11, 2024
Research Description
The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
Min -, max 2.2.65.
Status
vulnerable
Previous vulnerability researches
Post Grid for Elementor & Product Grid | PowerGrids (513b8cac04964f7c742c50353b32f41d519b21a5) , Jun 07, 2024
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget (CVE-2025-24782) , Jan 29, 2025
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget (CVE-2024-13408) , Jan 26, 2025
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget (CVE-2024-13409) , Jan 26, 2025
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget (CVE-2022-1266) , Jun 06, 2024
New vulnerability
String locator , Aug 13, 2025
Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler (CVE-2025-54028) , Aug 13, 2025
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks (CVE-2025-54007) , Aug 13, 2025
WooCommerce Purchase Orders (CVE-2025-5391) , Aug 13, 2025
RentSyst – CRM solution for fleet management (CVE-2025-48152) , Aug 12, 2025