Medium severity · published Jul 24, 2025
CVE-2025-5084
Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray['read_more_text']’ parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PG
Post Grid Master — Post Grids & AJAX Filters · mdshuvo
through 3.4.13 · source: vendor
PG
Post Grid Master · Addonmaster
through 3.4.13 · source: NVD
Affected product
PG
Post Grid Master — Post Grids & AJAX Filters
mdshuvo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5084
Exploit
https://github.com/Fr1t0viski/PoCs/blob/main/XSS_GridMaster
Product
https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.13/inc/functions.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.14/inc/functions.php
Release Notes
https://wordpress.org/plugins/ajax-filter-posts/#developers
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/08137a9e-6e4d-4ca6-954e-e98a44b0c9be?source=cve
More from Post Grid Master — Post Grids & AJAX Filters
9.8
CVE-2024-11642
Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion