Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Post Grid Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 29 vulnerability records associated with Post Grid, published between 2016 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

29Total records
2Critical
5High
22Medium
0Low
0Informational
27Patched records
2Currently marked unpatched
2016-11-08First disclosure
2025-12-21Latest disclosure
28 of 29CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201611 records
202122 records
202222 records
202322 records
20241313 records
202599 records

Severity Breakdown

SeverityRecordsShare
Critical26.9%
High517.2%
Medium2275.9%

Vulnerability-Type Breakdown

Cross-Site Scripting

15 records51.7%

First: 2021. Latest: 2025.

Missing Authorization

4 records13.8%

First: 2023. Latest: 2025.

Information Disclosure

3 records10.3%

First: 2024. Latest: 2025.

Privilege Escalation

3 records10.3%

First: 2024. Latest: 2025.

Other

2 records6.9%

First: 2025. Latest: 2025.

Path Traversal

1 record3.4%

First: 2016. Latest: 2016.

SQL Injection

1 record3.4%

First: 2021. Latest: 2021.

Patch Status

Patched
27
Currently marked unpatched
2
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 2.3.18
  • 2.3.12
  • 2.3.7
  • 2.3.6
  • 2.3.4
  • 2.2.93
  • 2.2.94
  • 2.2.90
  • 2.2.91
  • 2.2.88
  • 2.2.87
  • 2.2.86
  • 2.2.81
  • 2.2.79
  • 2.2.76
  • 2.2.69
  • 2.2.65
  • 2.2.51
  • 2.1.16
  • 2.1.13
  • 2.1.8
  • 2.0.13

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-2.3.21Post Grid and Gutenberg Blocks <= 2.3.21 - Authenticated (Contributor+) Stored Cross-Site ScriptingDecember 21, 2025Not suppliedMedium
*-2.3.19Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object ReferenceDecember 3, 2025Not suppliedMedium
*-2.3.17Post Grid and Gutenberg Blocks <= 2.3.17 - Missing AuthorizationOctober 4, 20252.3.18Medium
*-2.3.17Post Grid and Gutenberg Blocks <= 2.3.17 - Missing AuthorizationOctober 4, 20252.3.18Medium
*-2.3.11Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object InjectionAugust 6, 20252.3.12High
*-2.3.6Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information ExposureFebruary 27, 20252.3.7Medium
*-2.3.5Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order CreationFebruary 21, 20252.3.6Medium
2.2.85-2.3.3Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege EscalationJanuary 14, 20252.3.4Critical
*-2.2.92Post Grid and Gutenberg Blocks <= 2.2.92 - Authenticated (Contributor+) Stored Cross-Site ScriptingJanuary 14, 20252.2.93Medium
*-2.2.93Post Grid and Gutenberg Blocks <= 2.2.93 - Authenticated (Contributor+) Stored Cross-Site ScriptingOctober 24, 20242.2.94Medium
*-2.2.89Post Grid and Gutenberg Blocks <= 2.2.89 - Authenticated (Contributor+) Stored Cross-Site ScriptingSeptember 27, 20242.2.90Medium
2.2.87-2.2.90Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege EscalationSeptember 10, 20242.2.91High
*-2.2.84Gutenberg Blocks, Page Builder – ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion BlockAugust 13, 20242.2.88Medium
*-2.2.86ComboBlocks <= 2.2.86 - Authenticated (Contributor+) Stored Cross-Site ScriptingAugust 7, 20242.2.87Medium
*-2.2.85Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown WidgetJuly 31, 20242.2.86Medium
*-2.2.80Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site ScriptingJune 6, 20242.2.81Medium
*-2.2.80Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributeJune 6, 20242.2.81Medium
*-2.2.80Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site ScriptingMay 20, 20242.2.81Medium
*-2.2.78Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.78 - Unauthenticated Sensitive Information ExposureApril 22, 20242.2.79Medium
*-2.2.74Post Grid <= 2.2.74 - Reflected Cross-Site ScriptingMarch 28, 20242.2.76Medium
*-2.2.74Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel <= 2.2.74 - Information ExposureMarch 19, 20242.2.76Medium
*-2.2.68Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API EndpointMarch 12, 20242.2.69High
*-2.2.64Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site ScriptingDecember 15, 20232.2.65Medium
*-2.2.50Post Grid <= 2.2.50 - Missing Authorization to Sensitive Information Exposure via REST APIAugust 11, 20232.2.51High
[*, 2.1.16)Post Grid < 2.1.16 - Reflected Cross-Site ScriptingMarch 15, 20222.1.16Medium

Selected source records

Latest Records

MediumCVE-2025-68605

Post Grid and Gutenberg Blocks <= 2.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 21, 2025

Affected versions
*-2.3.21
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2025-63043

Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object Reference

Published: December 3, 2025

Affected versions
*-2.3.19
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2025-62924

Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization

Published: October 4, 2025

Affected versions
*-2.3.17
Patched versions
2.3.18
Original Wordfence record
MediumCVE-2025-66058

Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization

Published: October 4, 2025

Affected versions
*-2.3.17
Patched versions
2.3.18
Original Wordfence record
HighCVE-2025-54007

Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection

Published: August 6, 2025

Affected versions
*-2.3.11
Patched versions
2.3.12
Original Wordfence record
MediumCVE-2024-13796

Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure

Published: February 27, 2025

Affected versions
*-2.3.6
Patched versions
2.3.7
Original Wordfence record
MediumCVE-2024-13798

Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation

Published: February 21, 2025

Affected versions
*-2.3.5
Patched versions
2.3.6
Original Wordfence record
CriticalCVE-2024-9636

Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation

Published: January 14, 2025

Affected versions
2.2.85-2.3.3
Patched versions
2.3.4
Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-9636

Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation

Published: January 14, 2025

Affected versions
2.2.85-2.3.3
Patched versions
2.3.4
Original Wordfence record
Critical

Post Grid <= 2.0.12 - Arbitrary File Deletion

Published: November 8, 2016

Affected versions
*-2.0.12
Patched versions
2.0.13
Original Wordfence record
HighCVE-2021-4450

Post Grid <= 2.1.12 - Contributor+ SQL Injection

Published: December 15, 2021

Affected versions
[*, 2.1.13)
Patched versions
2.1.13
Original Wordfence record
HighCVE-2025-54007

Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection

Published: August 6, 2025

Affected versions
*-2.3.11
Patched versions
2.3.12
Original Wordfence record
HighCVE-2024-8253

Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation

Published: September 10, 2024

Affected versions
2.2.87-2.2.90
Patched versions
2.2.91
Original Wordfence record
HighCVE-2023-40211

Post Grid <= 2.2.50 - Missing Authorization to Sensitive Information Exposure via REST API

Published: August 11, 2023

Affected versions
*-2.2.50
Patched versions
2.2.51
Original Wordfence record
HighCVE-2023-7072

Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint

Published: March 12, 2024

Affected versions
*-2.2.68
Patched versions
2.2.69
Original Wordfence record
MediumCVE-2024-6346

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget

Published: July 31, 2024

Affected versions
*-2.2.85
Patched versions
2.2.86
Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-68605

Post Grid and Gutenberg Blocks <= 2.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 21, 2025

Affected versions
*-2.3.21
Patched versions
Not supplied
Original Wordfence record
MediumCVE-2025-63043

Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object Reference

Published: December 3, 2025

Affected versions
*-2.3.19
Patched versions
Not supplied
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory