CVE-2026-119054 Details
Description
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
A stored cross-site scripting vulnerability has been identified in the Multiple Pages Generator plugin by Themeisle, affecting versions prior to 4.2.5. This vulnerability allows Contributor-level users to inject scripts via the [mpg] and [mpg_match] shortcodes' base-url attribute. The injected payloads, which are entity-encoded to bypass the kses filter, are decoded by the html_entity_decode() function and rendered unescaped through the {{mpg_url}} placeholder. This execution of scripts occurs in the browsers of administrators viewing the affected content.
Users are advised to update the Multiple Pages Generator plugin by Themeisle to version 4.2.5 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Themeisle Multiple Pages Generator | >= 0, < 4.2.5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |