Stored Cross-Site Scripting Vulnerability in Content Pilot Plugin for WordPress

CVE-2026-111070

What is CVE-2026-111070?

The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to stored cross-site scripting in versions up to and including 2.2.4. This vulnerability arises from the plugin's inadequate sanitization process when extracting HTML meta descriptions from remotely fetched articles. As a result, attackers controlling the content of any RSS source configured within a Content Pilot RSS campaign can inject malicious web scripts, which execute whenever users access affected pages. This poses a significant risk as it allows potential exploitation from unauthenticated users, compromising the security and integrity of the affected sites.

References