CVE-2020-35937: Pickplugins Post Grid

High severity, CVSS 8.0. EPSS: 1.7% chance of exploitation in the next 30 days.

Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.

Affected products

• Pickplugins Post Grid: before 2.0.73 (fixed in 2.0.73)
• Pickplugins Team Showcase: before 1.22.16 (fixed in 1.22.16)

Published 2021-01-01. Last modified 2026-06-17.