CVE-2026-119054 — Vulnerability intelligence
—
Published:
- CVSS
- 5.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.