Read the docs
TI-2026-82412 Aliases CVE-2026-119054GHSA-pvqw-5gv9-r38m

Stored cross-site scripting in Multiple Pages Generator by Themeisle

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting flaw (CWE-79) in the base-url attribute of its [mpg] and [mpg_match] shortcodes. A contributor-level user can store input that passes sanitization and runs script in administrators' browsers.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.

Why it matters now

EPSS 0.00226 13th percentileScored 2026-11-07
Fix Fixed Multiple Pages Generator by Themeisle (Themeisle): 4.2.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
themeisleMultiple Pages Generator by Themeislebefore 4.2.54.2.5Patch availableCNA
  • Multiple Pages Generator by Themeisle Vendorthemeisle Affected before 4.2.5 Fixed in 4.2.5 Patch available CNA

Remediation

The fix is in Multiple Pages Generator by Themeisle version 4.2.5.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Multiple Pages Generator by Themeisle (Themeisle) Fixed in 4.2.5

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119054
  2. 2026-10-29 Alias added: GHSA-pvqw-5gv9-r38m

References

Patch 1

Other 4

  • TI-2017-14315 WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API CVSS 4.0CRITICAL 9.3
  • TI-2023-02146 Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization CVSS 3.1HIGH 8.8
  • TI-2023-20819 WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-12631 A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via… CVSS 3.1CRITICAL 10.0
  • TI-2023-02115 Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2022-04265 RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
See all 135 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences