Medium severity · published Oct 29, 2026
CVE-2026-119054
Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
New
5.4
CVSS
–
EPSS
No
On KEV
Description
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
Multiple Pages Generator by Themeisle · Themeisle
before 4.2.5 · source: vendor
Affected product
MP
Multiple Pages Generator by Themeisle
Themeisle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119054
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119054
patch
https://plugins.trac.wordpress.org/changeset/3742674/multiple-pages-generator-by-porthas
technical-description
https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/loop/Core.php
technical-description
https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/controllers/display/Base_Display.php
technical-description
https://plugins.svn.wordpress.org/multiple-pages-generator-by-porthas/tags/4.2.4/models/CoreModel.php
product
https://wordpress.org/plugins/multiple-pages-generator-by-porthas/
third-party-advisory
https://www.vulncheck.com/advisories/multiple-pages-generator-by-themeisle-before-4.2.5-stored-xss-via-shortcode-base-url