Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Smart Post WordPress plugin, which provides Gutenberg blocks for displaying post grids, carousels, and sliders, is affected by a stored cross-site scripting flaw. An authenticated user with basic subscriber access can inject malicious scripts through their display name, which may run in the browser of any visitor who views a page containing the plugin's Author Filter block.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown — a standard filter interaction requiring no elevated privileges from the victim.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- shapedplugin Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News
through 4.0.9
References 6
plugins.trac.wordpress.org
- browser/post-carousel/tags/4.0.8/blocks/includes/class-template-part.php#L1146
- browser/post-carousel/tags/4.0.8/blocks/assets/js/script.js#L1744
- browser/post-carousel/tags/4.0.8/blocks/includes/class-template-part.php#L1130
- changeset/3775298/post-carousel
- changeset/3775298/post-carousel/trunk/blocks/assets/js/script.js