A HIGH-severity stored cross-site scripting flaw has been disclosed in the Post Grid Gutenberg Blocks – PostX plugin for WordPress. Tracked as CVE-2026-96840 with a CVSS score of 7.2, the vulnerability affects all versions up to and including 5.1.0. The flaw sits in the plugin’s display_name user field handling: because WordPress core’s pre_user_display_name filter encodes some characters but leaves double-quotes intact, an attacker can store a double-quote character in their display name through /wp-admin/profile.php — breaking out of the alt=”” attribute in the plugin’s Archive_Title.php file and injecting arbitrary scripts into pages that execute whenever anyone visits them. The CVE was published on October 10, 2026.
Stored XSS is particularly dangerous because the malicious payload persists on the page itself — every visitor’s browser becomes a potential target for session theft, admin account compromise, or malware delivery. Site owners running PostX should update to the patched release as soon as it is available and verify their version in Dashboard → Plugins.
Plugins are where 91 percent of WordPress vulnerabilities live, which is why proactive maintenance matters. Qamar Digital Ventures LLC’s website care plans keep your plugins updated, monitored, and scanned — so flaws like this get addressed before attackers reach your site.
https://qamardigitalventuresllc.com/
Source: strix.ai CVE record (CVE-2026-96840), published October 10, 2026.