CVE-2026-111070

Name of the Vulnerable Software and Affected Versions The Content Pilot – Autoblogging & Affiliate Marketing Suite versions prior to 2.2.5

Description Stored Cross-Site Scripting occurs when the plugin extracts HTML meta descriptions from remotely-fetched articles using the parse meta() function in WPCP Readability. This value is processed through article template substitution and html entity decode() in WPCP Module::insert post(), then saved via wp insert post(). Because the process switches the current user to a campaign author with unfiltered html capabilities, the wp kses post sanitization is bypassed. Unauthenticated attackers who control the content of an RSS source used in a campaign can inject arbitrary web scripts that execute when a user views the affected page.

Recommendations Update the plugin to a version newer than 2.2.4.