CVE-2026-15100

Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post.

We have discovered 6,826 live websites that are affected by CVE-2026-15100.

Run a Free Instant Scan



Affected Software

Product  Ultimate Post
Category Wordpress Plugins
Vulnerable Domains6,826 live websites (100% of Ultimate Post install base)
Vulnerable Versions
  • from 0 through 5.0.32
Vulnerable Versions Count152 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 24, 2026
  • Updated - Jul 24, 2026

Credits

  • Wordfence PRISM (finder)

Website Distribution by Country

Number of websites using CVE-2026-15100
United States2,923 websites


Poland617 websites
Germany492 websites
France434 websites
GB216 websites
Spain201 websites
Cyprus144 websites
Italy143 websites
Netherlands132 websites
Brazil104 websites

Website Distribution by TLD

Number of websites using CVE-2026-15100
.com3,296 websites
.pl519 websites
.org409 websites
.de281 websites
.net206 websites
.fr144 websites
.it121 websites
.nl116 websites
.co.uk116 websites
.es97 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-15100

Top websites that are affected by CVE-2026-15100. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*********************.com United States**,***
******************************.pl Poland**,***
************.com United States**,***
******.com United States**,***
***********.net United States**,***
************.org Belgium***,***
*******.****.edu United States***,***
***.***.br Brazil***,***
***************************.de Germany***,***
****.***.ar Argentina***,***
See full domain list

FAQ

CVE-2026-15100 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Ultimate Post
A total of 6,826 websites have been identified as vulnerable to CVE-2026-15100, based on global website indexing conducted by WebTechSurvey.
The Ultimate Post is affected by the CVE-2026-15100 vulnerability.
Ultimate Post versions up to and including 5.0.32 are vulnerable to CVE-2026-15100.