CVE-2026-96840

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's pre_user_display_name filter encodes &, <, and > but leaves double-quotes intact (ENT_NOQUOTES), allowing a Subscriber-level user to store a double-quote in their display_name via /wp-admin/profile.php that subsequently breaks out of the alt="" attribute at Archive_Title.php:144.

• CWE-79

• https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.41/addons/builder/blocks/Archive_Title.php#L144
• https://plugins.trac.wordpress.org/browser/ultimate-post/tags/5.0.41/addons/builder/blocks/Archive_Title.php#L98
• https://plugins.trac.wordpress.org/changeset/3727209/ultimate-post/trunk/addons/builder/blocks/Archive_Title.php
• https://wordpress.org/plugins/ultimate-post/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/39472e87-174c-4abf-bc83-fed0939440af?source=cve

Published

Oct 10, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96833Editor PHP Object Injection in Ultimate Addons for Contact F…7.2
• CVE-2026-96834Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versi…6.5
• CVE-2026-96835Contributor Cross Site Scripting (XSS) in King Addons for El…6.5
• CVE-2026-96836Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= …7.1
• CVE-2026-96837Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.…8.8
• CVE-2026-96838Unauthenticated Cross Site Request Forgery (CSRF) in Blackli…8.8
• CVE-2026-96843Heap-based buffer overflow in WebDAV allows an authorized at…7.8
• CVE-2026-96844Integer underflow (wrap or wraparound) in Microsoft Bluetoot…8
• CVE-2026-96846Out-of-bounds read in WebDAV allows an authorized attacker t…5.5
• CVE-2026-96847Untrusted pointer dereference in WebDAV allows an authorized…7.8
• CVE-2026-96848Buffer over-read in Windows Win32 Kernel Subsystem allows an…5.5
• CVE-2026-96849Use of uninitialized resource in Windows Kernel-Mode Drivers…5.5