WordPress plugin
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High4
- Medium5
- Low0
All Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.8.0Update to 1.8.1 | CVE-2026-16260 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion ≤1.6.10Update to 1.7 | CVE-2025-24782 | |
| High7.5 | Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler() ≤1.6.10Update to 1.7 | CVE-2024-13409 | |
| High7.5 | Authenticated (Contributor+) Local File Inclusion ≤1.6.10Update to 1.7 | CVE-2024-13408 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.6.6Update to 1.6.7 | CVE-2024-29925 | |
| High8.8 | Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup ≤1.6.7Update to 1.6.8 | CVE-2024-2006 | |
| Medium4.3 | Missing Authorization ≤3.6.0Update to 3.6.1 | — | |
| Medium4.3 | Cross-Site Request Forgery ≤3.6.0Update to 3.6.1 | CVE-2022-47150 | |
| Medium5.5 | Authenticated (Admin+) Cross-Site Scripting <1.5.0Update to 1.5.0 | CVE-2022-1266 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.8.0Update to 1.8.1
- High8.8Authenticated (Contributor+) Local File Inclusion
≤1.6.10Update to 1.7
- High7.5Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()
≤1.6.10Update to 1.7
- High7.5Authenticated (Contributor+) Local File Inclusion
≤1.6.10Update to 1.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.6.6Update to 1.6.7
- High8.8Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup
≤1.6.7Update to 1.6.8
- Medium4.3Missing Authorization
≤3.6.0Update to 3.6.1
- Medium4.3Cross-Site Request Forgery
≤3.6.0Update to 3.6.1
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
<1.5.0Update to 1.5.0
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: common questions
Does Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: 4 high, 5 medium. At least one is not fixed in the latest version.
How do I check which version of Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget vulnerability?
CVE-2026-16260, published Aug 20, 2026: Post Grid, Slider & Carousel Ultimate <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget vulnerability listed in CISA KEV?
No. None of the known Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget vulnerabilities is currently listed in the CISA KEV catalog.