Skip to content
Sign in
7.1 High

CVE-2026-13726 The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the…

Description

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

Affected products and versions

Product Affected versions Fixed in
MPG 4.1 earliest → < 4.1.8 4.1.8

Other CVEs of MPG

The 3 CVEs of MPG →
CVE-2026-104953 The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it… 6.8 Medium CVE-2026-103293 The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is… 6.8 Medium
Track this CVE