CVE-2026-119054 in Multiple Pages Generator Plugin
Summary
by MITRE • 10/29/2026
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Multiple Pages Generator by Themeisle prior to version 4.2.5 represents a critical stored cross-site scripting flaw that exploits the interaction between WordPress content sanitization mechanisms and template rendering logic. This specific weakness allows users with Contributor-level permissions, who typically have limited capabilities within the WordPress ecosystem, to inject malicious JavaScript payloads into post or page content via shortcodes. The attack vector centers on the base-url attribute of the [mpg] and [mpg_match] shortcode structures. By carefully crafting input that bypasses the initial security filters, an attacker can persistently store these scripts in the database, ensuring they are executed whenever a privileged user views the affected content.
The technical mechanism behind this vulnerability lies in a mismatch between how data is sanitized upon entry and how it is rendered during output. WordPress employs a system known as kses to sanitize HTML attributes and tags based on an allowlist of permitted elements and attributes. The attacker's payload was designed to pass through this initial filtering stage, likely by using entity-encoded characters that are not explicitly blocked by the default or configured kses rules. However, when the theme processes these shortcodes for display, it applies html_entity_decode() to convert HTML entities back into their corresponding characters. Crucially, this decoded value is then passed directly into a Twig template variable {{mpg_url}} without subsequent escaping. Since Twig typically auto-escapes variables by default, the failure to escape or explicitly mark the output as safe allows the browser to interpret the injected script as executable code rather than plain text data.
From an operational perspective, this stored cross-site scripting vulnerability poses a severe risk because it does not require immediate user interaction beyond viewing the compromised page. Once the malicious content is saved by a Contributor-level user, any administrator or editor who views the post will have their browser execute the injected script in the context of the WordPress admin dashboard or site frontend. This can lead to session hijacking through cookie theft, allowing attackers to impersonate administrators and gain full control over the website. Additionally, it enables phishing attacks where users are redirected to malicious sites mimicking legitimate login pages, credential harvesting via keyloggers embedded in the script, or defacement of the public-facing site content. The persistence of the payload means that even if the initial Contributor account is disabled, the damage remains until the specific post or page containing the shortcode is manually edited and cleaned.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a cross-site scripting weakness. It also maps to MITRE ATT&CK technique T1059.007, specifically JavaScript execution within browser environments, often used in the initial access or persistence phases of an attack chain. The exploitation relies on the principle that data processed by server-side templates must be treated with equal rigor as user input received directly via forms.
To mitigate this vulnerability, site administrators should immediately update the Multiple Pages Generator plugin to version 4.2.5 or later, where the developers have addressed the improper escaping in the template rendering logic. For sites unable to upgrade instantly, a temporary workaround involves restricting Contributor-level users from using shortcodes that accept URL parameters until an official patch is applied. Security teams should also audit existing content for any suspicious shortcode usage and remove potentially compromised posts. Implementing a Content Security Policy header can further reduce the impact by preventing inline script execution, although this must be configured carefully to avoid breaking legitimate site functionality. Regular security audits of custom themes and plugins are essential to ensure that output encoding practices remain consistent with current web application security standards.