Medium
5.4
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting...
CVE-2026-119054
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Themeisle | Multiple Pages Generator by Themeisle |
< 4.2.5 |
4.2.5 |
Original description The description as published by the source.
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory