CVE-2020-35936: pickplugins post_grid Cross-site Scripting
Vulnerability summary
CVE-2020-35936 is a high (CVSS 8.0) Cross-site Scripting vulnerability in pickplugins post_grid. EPSS estimates a 1.67% chance of exploitation in the next 30 days, higher than 76.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 01-01-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA7.5HighCVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:NDiffers
- wordfenceSource7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.67%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 1.65% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Pickplugins2 products
- post_grid< 2.0.73
- team_showcase< 1.22.16
Wordpress1 product
- team< 1.22.16
2 vendors · 3 products
References
2 links- www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins/X Refsource MISCExploitThird Party Advisory