Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · post-grid-carousel-ultimate
Post Grid, Slider & Carousel Ultimate
7 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Post Grid, Slider & Carousel Ultimate safe? The full page →
Aug 22, 2026Post Grid, Slider & Carousel Ultimate: Does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screenCVE-2026-16260 · fixed in 1.8.1 · reported by WPScanMedium 6.8
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.
Jan 27, 2025Post Grid, Slider & Carousel Ultimate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24782 · affects up to 1.6.10 · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slider & Carousel Ultimate: from n/a through <= 1.6.10.
Jan 24, 2025Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: Local File InclusionCVE-2024-13409 · affects up to 1.6.10 · reported by WordfenceHigh 7.5
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the post_type_ajax_handler() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Jan 24, 2025Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: Local File InclusionCVE-2024-13408 · affects up to 1.6.10 · reported by WordfenceHigh 7.5
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included.
Mar 27, 2024Post Grid, Slider & Carousel Ultimate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29925 · affects up to 1.6.6 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate allows Stored XSS.This issue affects Post Grid, Slider & Carousel Ultimate: from n/a through 1.6.6.
Mar 13, 2024Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget: PHP Object InjectionCVE-2024-2006 · affects up to 1.6.7 · reported by WordfenceHigh 8.8
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of untrusted input in the outpost_shortcode_metabox_markup function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2022Post Grid, Slider & Carousel Ultimate: Does not sanitise and escape the Header TitleCVE-2022-1266 · fixed in 1.5.0 · reported by WPScanMedium 4.8
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.