{"id":"CVE-2026-119054","kind":"vulnerability","aliases":["CVE-2026-119054"],"related":[],"title":"Multiple Pages Generator WordPress plugin: stored XSS via shortcode base-url","description":"Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.","summary":"The Multiple Pages Generator plugin for WordPress, before 4.2.5, lets a Contributor-level user store entity-encoded script in the base-url attribute of its [mpg] and [mpg_match] shortcodes. The payload is decoded and rendered unescaped, so it runs in an administrator's browser when they view the content.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multiple-pages-generator","package","wordpress"],"not_affected_if":["no-contributor-users","plugin-not-installed","version-4.2.5-or-later"],"how_to_check":"- Check the installed Multiple Pages Generator plugin version in the WordPress admin Plugins screen; versions below `4.2.5` are affected.\n- Search post and page content for `[mpg` or `[mpg_match` shortcodes with a base-url attribute.","fix":"- Multiple Pages Generator by Themeisle: `4.2.5`","status":"open","published_at":"2026-10-29T14:17:52+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","triaged_at":"2026-10-29T14:26:04+00:00","updated_at":"2026-10-29T14:26:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T14:26:04Z","model":"claude-haiku-5-5","output":{"fix":"- Multiple Pages Generator by Themeisle: `4.2.5`","reach":"network","title":"Multiple Pages Generator WordPress plugin: stored XSS via shortcode base-url","impact":"medium","summary":"The Multiple Pages Generator plugin for WordPress, before 4.2.5, lets a Contributor-level user store entity-encoded script in the base-url attribute of its [mpg] and [mpg_match] shortcodes. The payload is decoded and rendered unescaped, so it runs in an administrator's browser when they view the content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","multiple-pages-generator"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in an administrator's browser session","analyst_note":"","how_to_check":"- Check the installed Multiple Pages Generator plugin version in the WordPress admin Plugins screen; versions below `4.2.5` are affected.\n- Search post and page content for `[mpg` or `[mpg_match` shortcodes with a base-url attribute.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-4.2.5-or-later","no-contributor-users"],"who_is_affected":"Sites running the Multiple Pages Generator plugin before 4.2.5 that let Contributor-level or higher users write content. The risk is to administrators who view the stored payload in the WordPress admin. Sites without the plugin, or on 4.2.5 or later, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4179,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119054':15A,18A '-2026':14A,17A '4.2.5':33B,84C 'administr':70B,139C 'allow':94C 'attack':113C 'attribut':50B,112C 'base':11A,48B,110C 'base-url':10A,47B,109C 'browser':72B,140C 'contain':85C 'content':77B 'contributor':37B,96C 'contributor-level':36B,95C 'cross':89C 'cross-sit':88C 'cve':13A,16A 'decod':61B,125C,129C 'encod':43B,118C 'entiti':42B,117C,128C 'entity-encod':41B,116C 'execut':136C 'generat':3A,22B,28B,80C 'html':127C 'inject':100C 'kses':122C 'let':34B 'level':38B,97C 'match':56B,107C 'mpg':53B,55B,104C,106C,134C 'multipl':1A,20B,26B,78C 'multiple-pages-gener':19B 'packag':23B 'page':2A,21B,27B,79C 'pass':121C 'payload':59B,119C 'plugin':5A,29B 'render':63B,131C 'run':67B 'script':44B,91C,101C,137C 'shortcod':9A,57B,108C 'site':90C 'store':6A,40B,87C,115C 'themeisl':82C 'unescap':64B,132C 'url':12A,49B,111C,135C 'user':39B,98C 'via':8A,102C 'view':75B 'vulner':92C 'wordpress':4A,24B,31B 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Multiple Pages Generator plugin before 4.2.5 that let Contributor-level or higher users write content. The risk is to administrators who view the stored payload in the WordPress admin. Sites without the plugin, or on 4.2.5 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T14:17:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119054","severity":null,"published_at":"2026-10-29T14:17:52+00:00","modified_at":"2026-10-29T14:17:52+00:00","first_seen_at":"2026-10-29T14:25:23+00:00","fetched_at":"2026-10-29T14:25:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}