Executive brief
Netroics Blog Posts Grid is a WordPress plugin used to display blog posts in a grid layout. A security flaw allows users with 'Editor' permissions to inject malicious scripts into post titles. If an administrator or another user views the affected post, the script could steal their login session or perform unauthorized actions on their behalf.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Netroics Blog Posts Grid plugin version 1.0 due to insufficient sanitization of the 'post_title' parameter within the testimonial title field. An authenticated attacker with Editor-level privileges can inject arbitrary JavaScript payloads that are stored on the server. When another user, such as an administrator, previews or views the draft post, the payload executes in their browser context. This can lead to session hijacking, cookie theft, and unauthorized administrative actions. The vulnerability was publicly disclosed with a proof-of-concept exploit.
Affected products
- Netroics Netroics Blog Posts Grid 1.0
Timeline
- 2022-08-08: other: Vulnerability discovered by researchers
- 2022-09-02: disclosed: Exploit published on Exploit-DB
- 2026-05-10: advisory: CVE published by VulnCheck/NVD