5.1
Medium
CVE-2026-119054 Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
Description
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:NExploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- Interaction
- Passive
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
- Confidentiality of other systems
- Low
- Integrity of other systems
- Low
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Multiple Pages Generator by Themeisle 4.2 | earliest → < 4.2.5 | 4.2.5 |