CVE-2026-119054: falha de média gravidade em Themeisle Multiple Pages Generator by Themeisle
Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Themeisle · Multiple Pages Generator by ThemeisleReferências
https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/Base_Display.phphttps://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/loop/Core.phphttps://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/models/CoreModel.phphttps://plugins.trac.wordpress.org/changeset/3742674/multiple-pages-generator-by-porthashttps://wordpress.org/plugins/multiple-pages-generator-by-porthas/https://www.vulncheck.com/advisories/multiple-pages-generator-by-themeisle-before-4.2.5-stored-xss-via-shortcode-base-url