CVE-2026-119054

Name of the Vulnerable Software and Affected Versions Multiple Pages Generator by Themeisle versions prior to 4.2.5

Description Stored cross-site scripting occurs due to insufficient input sanitization and output escaping. Authenticated users with Contributor-level access and above can inject arbitrary web scripts via the base-url attribute of the [mpg] and [mpg match] shortcodes. Attackers can use entity-encoded payloads that bypass kses (a WordPress function used to sanitize HTML) but are subsequently decoded by html entity decode() and rendered unescaped through {{mpg url}}, leading to script execution in the browsers of administrators.

Recommendations Update to version 4.2.5 or later.