Bulk Page Generator Lpagery
Monthly
Stored cross-site scripting in the Lpagery (Bulk Page Generator) WordPress plugin, versions up to and including 2.5.7, allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via crafted post titles. The vulnerability stems from the lpagery_add_filter_text_template_post() function echoing a raw post_title directly into an inline JavaScript single-quoted string literal on every admin page load, with no encoding applied. When an administrator accesses an admin page bearing the ?lpagery_template parameter pointing to the attacker's post, the injected payload executes in the admin's browser context, enabling session hijacking or unauthorized privileged actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the Lpagery (Bulk Page Generator) WordPress plugin, versions up to and including 2.5.7, allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via crafted post titles. The vulnerability stems from the lpagery_add_filter_text_template_post() function echoing a raw post_title directly into an inline JavaScript single-quoted string literal on every admin page load, with no encoding applied. When an administrator accesses an admin page bearing the ?lpagery_template parameter pointing to the attacker's post, the injected payload executes in the admin's browser context, enabling session hijacking or unauthorized privileged actions. No public exploit code or CISA KEV listing has been identified at time of analysis.