CVE-2024-43156 WordPress Post Grid Master plugin <= 3.4.10 - Reflected Cross Site Scripting (XSS) vulnerability

What is CVE-2024-43156?

CVE-2024-43156 is a high-severity cross-site scripting vulnerability in AddonMaster Post Grid Master, published on 12 Aug 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Reflected XSS.This issue affects Post Grid Master: from n/a through 3.4.10.

Weakness: CWE-79

Which versions are affected by CVE-2024-43156?

It affects 1 product.

Products include Addonmaster Post Grid Master.

How do I fix CVE-2024-43156?

No fix has been published for CVE-2024-43156 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-43156 being exploited?

There is no known exploitation of CVE-2024-43156 in the wild and no public exploit code.

Other vulnerabilities in AddonMaster Post Grid Master

• CVE-2024-11642 Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion Critical 9.8
• CVE-2025-24733 WordPress Post Grid Master plugin <= 3.4.12 - Local File Inclusion vulnerability Medium 6.5
• CVE-2024-34390 WordPress Post Grid Master plugin <= 3.4.8 - Auth. Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2025-5084 Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text'] Medium 6.1
• CVE-2024-34372 WordPress Post Grid Master plugin <= 3.4.7 - Broken Access Control vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4p53-mpmm-4v8c.