Stored XSS in Multiple Pages Generator by Themeisle

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Multiple Pages Generator by Themeisle plugin for WordPress. It affects versions before 4.2.5. Contributor-level users can inject malicious scripts via the base-url attribute in the [mpg] and [mpg_match] shortcodes. The issue occurs because entity-encoded payloads bypass the kses filter but are later decoded and rendered unescaped through the {{mpg_url}} template, allowing script execution in administrators' browsers.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress installations for the Multiple Pages Generator by Themeisle plugin versions prior to 4.2.5. Inspect shortcode usage in posts or pages for [mpg] or [mpg_match] with base-url attributes containing suspicious payloads. Review admin browser logs for unexpected script execution.

Useful 0 Not Useful 0

Impact Analysis

Attackers with Contributor-level access can inject malicious scripts that execute in the browsers of administrators or other users with higher privileges. This could lead to unauthorized actions, data theft, or further compromise of the WordPress site. The vulnerability enables persistent script storage, meaning the payload remains active until removed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information if exploited. Compliance failures could result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

• Update the Multiple Pages Generator by Themeisle plugin to version 4.2.5 or later.
• Audit all [mpg] and [mpg_match] shortcodes for malicious base-url attributes.
• Restrict Contributor-level user permissions to prevent unauthorized shortcode modifications.

Useful 0 Not Useful 0