CVE-2026-92424: Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with contributor-level access or higher can exploit it by using the bulk content-import feature. The issue involves selecting an import preset that the user is not authorized to use.
What access or conditions are required for exploitation?
The attacker needs an account with at least contributor permissions and access to the plugin's bulk content-import functionality. They must be able to select an import preset associated with another author.
What is the impact after malicious content is imported?
The attacker can cause arbitrary web scripts to be stored in a post under a privileged user's identity. Those scripts execute in the browser context of users who later view the affected content.
How can administrators identify potentially affected content?
Review posts created through Content Egg bulk imports, particularly posts attributed to privileged users where the initiating user may have had only contributor-level access. Inspect imported post content for unexpected or untrusted script-bearing content.