MEDIUM 5.1 NVD
CVE-2026-119054
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
References
- https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controlle
- https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controlle
- https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/models/Co
- https://plugins.trac.wordpress.org/changeset/3742674/multiple-pages-generator-by-porthas
- https://wordpress.org/plugins/multiple-pages-generator-by-porthas/
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-10-29 via NVD.
vulnfeed aggregates 16756 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.