CVE-2026-111070: Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`

Published Oct 31, 2026

Updated

The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4. This is due to the plugin extracting the HTML meta description from each remotely-fetched article (WPCPReadability::parsemeta()), piping that value through the article template substitution and htmlentitydecode() in WPCPModule::insertpost(), and then calling wpinsertpost() after switching the current user to the configured campaign author (an Administrator with the unfilteredhtml capability by default) — so no wpksespost sanitization is applied to the attacker-controlled HTML before it is persisted as postcontent and rendered on the front end. This makes it possible for unauthenticated attackers who control the content of any RSS source an administrator has configured a Content Pilot RSS campaign to consume to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Event History

Oct 31, 2026

CVE Published

via MITRE·07:46 AM

Data Sourced

via MITRE·07:46 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Content Pilot versions up to and including 2.2.4 are exposed when an administrator has configured an RSS campaign that consumes a source whose content an attacker can control. The injected content is stored in imported WordPress posts and executes when users visit those posts.

What does an attacker need to exploit it?

The attacker does not need WordPress authentication or user interaction to place the payload. They need control over content from an RSS source configured in a Content Pilot campaign, including the remotely fetched article's meta description.

Are default campaign-author settings relevant?

Yes. By default, the plugin inserts posts as the configured campaign author, described as an Administrator with the unfiltered_html capability. In that context, the attacker-controlled HTML is not sanitized with wp_kses_post before being saved as post content.

What can be done if patching is not immediately possible?

Disable affected RSS campaigns or remove RSS sources that could be controlled or modified by untrusted parties. Review already imported posts from those campaigns, because malicious content may already be persisted and rendered on the site.

CVE-2026-111070: Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are default campaign-author settings relevant?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are default campaign-author settings relevant?

What can be done if patching is not immediately possible?