Stored Cross-Site Scripting in Lpagery Plugin for WordPress

CVE-2026-15404

What is CVE-2026-15404?

The Lpagery plugin for WordPress, versions up to 2.5.7, is susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping in the lpagery_add_filter_text_template_post() function. Specific post titles can be directly echoed within a JavaScript context without proper encoding, enabling authenticated attackers with Contributor-level access or higher to inject malicious scripts. These scripts can be executed whenever a user with elevated privileges, such as an administrator, views a page that references the attacker's post through the appropriate query parameter.

References