Plugin security history

Post Grid Gutenberg Blocks – PostX Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 26 vulnerability records associated with Post Grid Gutenberg Blocks – PostX, published between 2021 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

26Total records

0Critical

6High

20Medium

0Low

0Informational

26Patched records

0Currently marked unpatched

2021-08-17First disclosure

2026-07-23Latest disclosure

26 of 26CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2021	4	4 records
2023	2	2 records
2024	10	10 records
2025	5	5 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
High	6	23.1%
Medium	20	76.9%

Vulnerability-Type Breakdown

Cross-Site Scripting

14 records53.8%

First: 2021. Latest: 2026.

Missing Authorization

8 records30.8%

First: 2021. Latest: 2026.

Information Disclosure

2 records7.7%

First: 2021. Latest: 2025.

Privilege Escalation

1 record3.8%

First: 2025. Latest: 2025.

Other

1 record3.8%

First: 2026. Latest: 2026.

Patch Status

Patched: 26
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.0.33
5.0.32
5.0.6
5.0.9
5.0.4
4.1.37
4.1.36
4.1.26
4.1.17
4.1.16
4.1.13
4.1.2
4.1.3
4.1.0
4.0.2
3.2.4
3.0.6
2.9.10
2.4.10

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.0.32`	Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute	July 23, 2026	5.0.33	Medium
`*-5.0.31`	Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute	July 8, 2026	5.0.32	Medium
`*-5.0.5`	Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification	April 15, 2026	5.0.6	Medium
`*-5.0.8`	PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints	March 3, 2026	5.0.9	High
`*-5.0.3`	PostX <= 5.0.3 - Missing Authorization	January 19, 2026	5.0.4	Medium
`*-5.0.3`	PostX <= 5.0.3 - Unauthenticated Information Exposure	December 21, 2025	5.0.4	Medium
`*-5.0.3`	Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure	December 20, 2025	5.0.4	High
`*-4.1.36`	PostX <= 4.1.36 - Missing Authorization	September 2, 2025	4.1.37	Medium
`*-4.1.35`	PostX <= 4.1.35 - Authenticated (Editor+) Privilege Escalation	August 29, 2025	4.1.36	High
`*-4.1.25`	PostX <= 4.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting	March 28, 2025	4.1.26	Medium
`*-4.1.15`	PostX <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 2, 2024	4.1.16	Medium
`*-4.1.16`	PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation	November 15, 2024	4.1.17	High
`*-4.1.15`	PostX <= 4.1.15 - Authenticated (Author+) Stored Cross-Site Scripting	October 28, 2024	4.1.16	Medium
`*-4.1.12`	PostX <= 4.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting	October 24, 2024	4.1.13	Medium
`*-4.1.1`	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting	May 29, 2024	4.1.2	Medium
`*-4.1.2`	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update	May 29, 2024	4.1.3	High
`*-4.0.4`	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.4 - Authenticated (Contributor+) Stored Cross=Site Scripting	May 27, 2024	4.1.0	Medium
`*-4.0.1`	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 22, 2024	4.0.2	Medium
`*-4.0.1`	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	April 16, 2024	4.0.2	Medium
`*-3.2.3`	PostX – Gutenberg Blocks for Post Grid <= 3.2.3 - Incorrect Authorization	April 5, 2024	3.2.4	Medium
`*-3.0.5`	PostX - Gutenberg Post Grid Blocks <= 3.0.5 - Reflected Cross-Site Scripting via 'postx_type'	August 2, 2023	3.0.6	Medium
`*-2.9.9`	PostX – Gutenberg Blocks for Post Grid <= 2.9.9 - Unauthenticated Cross-Site Scripting	June 23, 2023	2.9.10	High
`*-2.4.9`	PostX Gutenberg Blocks Saved Templates Addon <= 2.4.9 - Private Content Disclosure	August 26, 2021	2.4.10	Medium
`[*, 2.4.10)`	PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Stored Cross-Site Scripting	August 26, 2021	2.4.10	Medium
`[*, 2.4.10)`	PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 26, 2021	2.4.10	Medium

Selected source records

Latest Records

MediumCVE-2026-15100

Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute

Published: July 23, 2026

Affected versions: *-5.0.32
Patched versions: 5.0.33

Original Wordfence record

MediumCVE-2026-13253

Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute

Published: July 8, 2026

Affected versions: *-5.0.31
Patched versions: 5.0.32

Original Wordfence record

MediumCVE-2026-0718

Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification

Published: April 15, 2026

Affected versions: *-5.0.5
Patched versions: 5.0.6

Original Wordfence record

HighCVE-2026-1273

PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints

Published: March 3, 2026

Affected versions: *-5.0.8
Patched versions: 5.0.9

Original Wordfence record

MediumCVE-2025-69313

PostX <= 5.0.3 - Missing Authorization

Published: January 19, 2026

Affected versions: *-5.0.3
Patched versions: 5.0.4

Original Wordfence record

MediumCVE-2025-68606

PostX <= 5.0.3 - Unauthenticated Information Exposure

Published: December 21, 2025

Affected versions: *-5.0.3
Patched versions: 5.0.4

Original Wordfence record

HighCVE-2025-12980

Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure

Published: December 20, 2025

Affected versions: *-5.0.3
Patched versions: 5.0.4

Original Wordfence record

MediumCVE-2025-54751

PostX <= 4.1.36 - Missing Authorization

Published: September 2, 2025

Affected versions: *-4.1.36
Patched versions: 4.1.37

Original Wordfence record

Highest-Severity Records

HighCVE-2024-10728

PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation

Published: November 15, 2024

Affected versions: *-4.1.16
Patched versions: 4.1.17

Original Wordfence record

HighCVE-2024-5326

Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update

Published: May 29, 2024

Affected versions: *-4.1.2
Patched versions: 4.1.3

Original Wordfence record

HighCVE-2025-12980

Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure

Published: December 20, 2025

Affected versions: *-5.0.3
Patched versions: 5.0.4

Original Wordfence record

HighCVE-2025-55707

PostX <= 4.1.35 - Authenticated (Editor+) Privilege Escalation

Published: August 29, 2025

Affected versions: *-4.1.35
Patched versions: 4.1.36

Original Wordfence record

HighCVE-2026-1273

PostX <= 5.0.8 - Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints

Published: March 3, 2026

Affected versions: *-5.0.8
Patched versions: 5.0.9

Original Wordfence record

HighCVE-2023-36385

PostX – Gutenberg Blocks for Post Grid <= 2.9.9 - Unauthenticated Cross-Site Scripting

Published: June 23, 2023

Affected versions: *-2.9.9
Patched versions: 2.9.10

Original Wordfence record

MediumCVE-2021-24652

PostX - Gutenberg Blocks for Post Grid <= 2.4.9 - Unauthorized Access Controls

Published: August 17, 2021

Affected versions: [*, 2.4.10)
Patched versions: 2.4.10

Original Wordfence record

MediumCVE-2026-13253

Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute

Published: July 8, 2026

Affected versions: *-5.0.31
Patched versions: 5.0.32

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory