CVE-2026-10089

Name of the Vulnerable Software and Affected Versions Insert Pages versions prior to 3.11.5

Description Stored Cross-Site Scripting occurs when an inserted page is rendered using the [insert page='ID' display='all'] shortcode. The issue stems from insufficient output escaping within the the meta() function, where the custom field key key is interpolated into the HTML and echoed without escaping, although the field value is sanitized. This allows authenticated attackers with author-level access or higher to inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update to a version newer than 3.11.4.