CVE-2025-5084

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5084", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-22T09:02:21.166Z", "datePublished": "2025-07-24T09:22:15.279Z", "dateUpdated": "2026-04-08T16:34:07.683Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:07.683Z"}, "affected": [{"vendor": "mdshuvo", "product": "Post Grid Master \u2014 Post Grids & AJAX Filters", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.4.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018argsArray['read_more_text']\u2019 parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08137a9e-6e4d-4ca6-954e-e98a44b0c9be?source=cve"}, {"url": "https://github.com/Fr1t0viski/PoCs/blob/main/XSS_GridMaster"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.13/inc/functions.php"}, {"url": "https://wordpress.org/plugins/ajax-filter-posts/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.14/inc/functions.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Alefe Souza"}], "timeline": [{"time": "2025-07-23T20:38:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-24T13:15:40.557084Z", "id": "CVE-2025-5084", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-24T13:15:54.619Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5084", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-24T13:15:40.557084Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-24T13:15:52.104Z"}}], "cna": {"title": "Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']", "credits": [{"lang": "en", "type": "finder", "value": "Alefe Souza"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "mdshuvo", "product": "Post Grid Master \u2013 Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.4.13"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-23T20:38:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08137a9e-6e4d-4ca6-954e-e98a44b0c9be?source=cve"}, {"url": "https://github.com/Fr1t0viski/PoCs/blob/main/XSS_GridMaster"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.13/inc/functions.php"}, {"url": "https://wordpress.org/plugins/ajax-filter-posts/#developers"}], "descriptions": [{"lang": "en", "value": "The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018argsArray['read_more_text']\u2019 parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-24T09:22:15.279Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5084", "state": "PUBLISHED", "dateUpdated": "2025-07-24T13:15:54.619Z", "dateReserved": "2025-05-22T09:02:21.166Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-24T09:22:15.279Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Post Grid Master \u2014 Post Grids & AJAX Filters", "vendor": "mdshuvo", "versions": [{"lessThanOrEqual": "3.4.13", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:addonmaster:post_grid_master:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "CBB0EEC6-CEDB-4057-92AA-4A6796029176", "versionEndIncluding": "3.4.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018argsArray['read_more_text']\u2019 parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Post Grid Master para WordPress es vulnerable a ataques de Cross-Site Scripting reflejado a trav\u00e9s del par\u00e1metro 'argsArray['read_more_text']' en todas las versiones hasta la 3.4.13 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutan si logran enga\u00f1ar al usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-5084", "lastModified": "2026-06-17T09:47:10.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5084", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-24T13:15:40.557084Z", "version": "2.0.3"}}]}, "published": "2025-07-24T10:15:26.643", "references": [{"source": "security@wordfence.com", "tags": ["Exploit"], "url": "https://github.com/Fr1t0viski/PoCs/blob/main/XSS_GridMaster"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.13/inc/functions.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.14/inc/functions.php"}, {"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://wordpress.org/plugins/ajax-filter-posts/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08137a9e-6e4d-4ca6-954e-e98a44b0c9be?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:03:02.904055+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest available version of Post Grid Master once the vendor confirms the vulnerability is fixed.", "If upgrading immediately is not feasible, temporarily disable or cleanse the read_more_text parameter to eliminate the XSS vector.", "Implement a web application firewall or a content security policy that blocks execution of unexpected inline scripts as an additional layer of defense."], "summary": {"action": "Apply Patch", "impact": "Reflected Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The weakness affects the WordPress plugin \"Post Grid Master\" supplied by mdshuvo. All releases up to and including version 3.4.13 are vulnerable. No fixed version is specified in the CVE payload, so the status of newer releases remains unknown.", "description_and_impact": "The Post Grid Master plugin processes the argsArray['read_more_text'] parameter without proper sanitization or escaping, allowing an unauthenticated attacker to inject malicious JavaScript that is reflected back into the page. When the victim visits the crafted URL, the injected code executes in the context of the target site, enabling credential theft, session hijacking, defacement, or other client\u2011side attacks. This vulnerability is a classic instance of CWE\u201179, a reflected XSS weakness.", "risk_and_exploitability": "With a CVSS base score of 6.1, the flaw is considered moderate severity. The EPSS score of less than 1% indicates a low likelihood that attackers are actively exploiting it, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a reflected XSS that requires an end\u2011user to interact with a malicious link or page, so the threat is limited to users visiting a compromised or crafted URL."}}}}, "created": "2025-07-24T21:26:41.429782+00:00", "updated": "2026-04-22T17:15:22.191659+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}