Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-85198

MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themeisle Wordpress
Products
Mpg – Multiple Page Generator, Bulk Landing Pages & Programmatic Seo Wordpress
CVE-2026-13726

Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themeisle Wordpress
Products
Mpg Wordpress