EUVD-2026-41249
GHSA-6x9h-hg2c-hwf8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Author-level write access (PR:L) required; stored payload executes for any visitor without further attacker interaction (UI:N); scope change (S:C) reflects cross-browser-context impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and including, 3.11.4. This is due to insufficient output escaping in the the_meta() function: while the custom field VALUE is sanitized with wp_kses_post(), the custom field KEY ($key) is interpolated into the rendered HTML (lines 1786-1791) and echoed (line 1806) without any escaping when an inserted page is rendered with the [insert page='ID' display='all'] shortcode. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Insert Pages WordPress plugin (versions through 3.11.4) allows authenticated attackers with author-level access to persist arbitrary JavaScript via post custom field key names. The vulnerability arises because the the_meta() function applies wp_kses_post() to custom field values but interpolates the custom field KEY directly into rendered HTML without any escaping, exploitable only when the [insert page='ID' display='all'] shortcode is used. Any visitor loading a page containing the shortcode will execute the attacker's payload in their browser, enabling session hijacking or credential theft; no public exploit identified at time of analysis.
Technical ContextAI
Insert Pages is a WordPress plugin that enables embedding one post's content within another using a shortcode. The vulnerable path is in the the_meta() function (insert-pages.php, lines 1786-1791 and 1806 in the 3.11.3/3.11.4 branches), where post custom field (meta) data is iterated and rendered into HTML. WordPress's wp_kses_post() sanitization is applied to the meta VALUE but the meta KEY ($key) is directly interpolated into the HTML output without escaping. Since WordPress author-level users can create posts with arbitrary meta key names, a malicious actor can store a key name containing a <script> tag or event handler. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: a user-controlled string is reflected into the DOM without output encoding. The vulnerable rendering path is only invoked by the display='all' shortcode parameter, constraining exposure to pages explicitly using that display mode.
RemediationAI
An upstream fix has been committed at https://plugins.trac.wordpress.org/changeset/3579298; however, no specific patched release version number is independently confirmed from the available data - administrators should update Insert Pages to the latest available version from the WordPress plugin repository to obtain this fix. As a compensating control while updates are applied, restrict the author role from creating or modifying post custom field (meta) keys by using a role-management plugin to revoke meta capability, which removes the attack surface entirely but may limit legitimate content-authoring workflows. Alternatively, audit all usages of the [insert page='ID' display='all'] shortcode and convert them to display modes that do not invoke the_meta() rendering; disabling the display='all' parameter eliminates the vulnerable code path with no impact on other shortcode display modes. Deploying a WAF rule to strip HTML tags from meta key name input at the application layer provides defense-in-depth but does not substitute for patching.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today