CVE-2026-119054: Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpgmatch] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by htmlentitydecode() and rendered unescaped through {{mpgurl}}, executing script in administrators' browsers.
Event History
Frequently Asked Questions
Which users can introduce the malicious content?
Contributor-level users can inject the payload through the base-url attribute of the [mpg] or [mpg_match] shortcode.
When does the injected script execute?
The payload is stored and executes in an administrator's browser when the affected shortcode output is rendered. The issue crosses privilege boundaries because the injected content can affect higher-privileged administrators.
What should be reviewed to identify possible exploitation?
Review content created or edited by Contributor-level users for [mpg] and [mpg_match] shortcodes with suspicious entity-encoded values in the base-url attribute. Such values can pass kses filtering, be decoded by html_entity_decode(), and reach the unescaped {{mpg_url}} output.
Which versions are affected?
Multiple Pages Generator by Themeisle versions before 4.2.5 are affected.