Stored Cross-Site Scripting in Multiple Pages Generator by Themeisle

CVE-2026-119054

What is CVE-2026-119054?

The Multiple Pages Generator plugin by Themeisle prior to version 4.2.5 is susceptible to a stored cross-site scripting vulnerability. This flaw permits Contributor-level users to inject malicious scripts via the shortcode base-url attribute. Attackers can exploit this by storing encoded payloads that pass security filters but are subsequently decoded and rendered without proper escaping in the browser of administrators. This presents significant security risks as malicious scripts could execute in the context of users accessing the affected pages.

References