Content Views – Post Grid & Filter
Content Views – Post Grid & Filter is a WordPress component with 3 published CVE records in this archive. The latest tracked vulnerability was published Aug 07, 2026; the highest published CVSS base score is 8.1.
content-views-query-and-display-post-pageCVE-2026-15361: Content Views preview_request permits Subscriber-level SQL injection before 4.5
Content Views before 4.5 registers authenticated AJAX action preview_request to PT_CV_Functions::ajax_callback_preview_request() without checking the configured Content Views capability. A Subscriber sends serialized settings in POST data; view_process_settings() accepts attacker-supplied pt-cv-rebuild on the path through get_posts_list() to the WordPress query. Version 4.5 adds the capability check and removes pt-cv-rebuild. The final subparameter, SQL statement, sink function, extraction method and affected records are not disclosed.
| Safe version |
|
||
|---|---|---|---|
| Aug 07, 2026 |
CVE-2026-15361
Content Views preview_request permits Subscriber-level SQL injection before 4.5
Content Views before 4.5 registers authenticated AJAX action preview_request to PT_CV_Functions::ajax_callback_preview_request() without checking the configured Content Views capability. A Subscriber sends serialized settings in POST data; view_process_settings() accepts attacker-supplied pt-cv-rebuild on the path through get_posts_list() to the WordPress query. Version 4.5 adds the capability check and removes pt-cv-rebuild. The final subparameter, SQL statement, sink function, extraction method and affected records are not disclosed.
|
4.5 |
CVE8.1
NVDPending
|
| Sep 06, 2025 |
CVE-2025-8722
Content Views: Cross-site scripting
Content Views is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.4
NVDPending
|
| May 14, 2024 |
CVE-2024-4446
Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode): Cross-site scripting
Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.4
NVDPending
|