CVE-2023-6645 in Post Grid Combo Plugin
Summary
by MITRE • 01/11/2024
The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6645 affects the Post Grid Combo plugin for WordPress, specifically targeting versions up to and including 2.2.64. This plugin provides over thirty Gutenberg blocks for content creation and grid layouts, making it a widely used component in WordPress environments. The flaw resides in the handling of the custom JS parameter within the plugin's functionality, creating a persistent security weakness that can be exploited by authenticated users with contributor-level privileges or higher. The vulnerability manifests as a stored cross-site scripting attack vector, where malicious scripts can be permanently embedded within the plugin's configuration parameters.
The technical implementation of this vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase. When administrators or users with sufficient privileges enter custom JavaScript code through the affected parameter, the system fails to properly validate or sanitize this input before storing it in the database. Additionally, the output escaping mechanisms that should protect against XSS attacks are insufficient or missing entirely when rendering the stored JavaScript code back to users. This combination creates a persistent XSS vulnerability where the malicious script remains stored in the system and executes whenever any user accesses pages containing the injected content.
The operational impact of this vulnerability is significant for WordPress environments utilizing the affected plugin. Attackers with contributor access or higher can leverage this weakness to execute arbitrary scripts in the context of any user's browser who accesses pages containing the malicious content. This could enable attackers to steal user sessions, perform actions on behalf of users, redirect them to malicious sites, or exfiltrate sensitive data from the WordPress administration interface. The stored nature of the vulnerability means that the malicious scripts persist even after the initial injection, potentially affecting multiple users over extended periods until the vulnerability is patched or the malicious content is manually removed.
Organizations affected by this vulnerability should immediately update to the latest version of the Post Grid Combo plugin where the XSS flaw has been addressed through proper input validation and output escaping mechanisms. Security teams should also implement monitoring for suspicious activity in the plugin's configuration parameters and conduct thorough audits of user permissions to minimize the risk of unauthorized access. The vulnerability aligns with CWE-79, which specifically addresses Cross-Site Scripting flaws in software applications, and represents a clear violation of secure coding practices that should prevent untrusted data from being executed as code. From an ATT&CK framework perspective, this vulnerability maps to T1566.001 - Phishing via Social Engineering and T1059.007 - Command and Scripting Interpreter: JavaScript, as it enables attackers to execute malicious JavaScript code through the WordPress platform. The remediation process should include comprehensive security testing of all plugin parameters, implementation of proper input validation at multiple layers, and ensuring that all user-supplied content is properly escaped before rendering in web pages to prevent similar vulnerabilities from emerging in the future.