Live › vulnerability › CVE-2026-119054
The Multiple Pages Generator plugin for WordPress, before 4.2.5, lets a Contributor-level user store entity-encoded script in the base-url attribute of its [mpg] and [mpg_match] shortcodes. The payload is decoded and rendered unescaped, so it runs in an administrator's browser when they view the content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Sites running the Multiple Pages Generator plugin before 4.2.5 that let Contributor-level or higher users write content. The risk is to administrators who view the stored payload in the WordPress admin. Sites without the plugin, or on 4.2.5 or later, can skip it.
No product ranges from the sources yet.
4.2.5 are affected.[mpg or [mpg_match shortcodes with a base-url attribute.4.2.5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
This page as .md · .json · in your agent: get_signal("CVE-2026-119054")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.