CVE-2026-13726

HighCVSS 7.1

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The MPG WordPress plugin before version 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response. Unauthenticated attackers can perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

Risk Assessment

An unauthenticated attacker can execute a script in the victim's browser, leading to session or data theft.

Recommendation

Update the MPG plugin to version 4.1.8 or later.

Other vulnerabilities in MPG WordPress plugin

CVE-2026-104953Medium
The MPG WordPress plugin before version 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.

Original NVD description (English source)

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS