Vulnerability Description
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4
- https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4
- https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4
- https://plugins.trac.wordpress.org/changeset/3742674/multiple-pages-generator-by
- https://wordpress.org/plugins/multiple-pages-generator-by-porthas/
- https://www.vulncheck.com/advisories/multiple-pages-generator-by-themeisle-befor
FAQ
What is CVE-2026-119054?
CVE-2026-119054 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode bas...
How severe is CVE-2026-119054?
CVE-2026-119054 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119054?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.