CVE-2026-15404

MediumCVSS 6.4

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

The Lpagery plugin for WordPress up to version 2.5.7 has a Stored XSS vulnerability in the lpagery_add_filter_text_template_post() function. The function echoes the raw post title inside a JavaScript string without proper encoding, allowing authenticated attackers with contributor-level access or higher to inject scripts. The attack requires an admin to visit a page with the ?lpagery_template=<post_id> parameter.

Risk Assessment

An attacker can inject a script that executes in the admin panel context, potentially leading to admin account takeover.

Recommendation

Update the Lpagery plugin to the latest patched version.

Other vulnerabilities in Lpagery

CVE-2026-110019Medium
The Bulk Page Generator – LPagery plugin for WordPress in versions up to and including 3.1.0 is vulnerable to authorization bypass because it does not properly verify that a user is authorized to perform an action. An authenticated attacker with subscriber-level access and above can create, modify, and delete LPagery-managed pages and bulk page-generation processes otherwise restricted to administrators. On default fresh installations where Freemius has not been opted into, the AES-256-CBC key used to validate Bearer tokens collapses to the publicly known SHA-256 hash of an empty string, making the token entirely forgeable.

Original NVD description (English source)

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpagery_add_filter_text_template_post() function, which is hooked to admin_footer and echoes the raw post_title of the post referenced by the ?lpagery_template query parameter directly inside a JavaScript single-quoted string literal, without esc_js(), esc_html(), or any other encoding. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher-privileged user (such as an administrator) accesses an admin page with the ?lpagery_template=<post_id> parameter pointing at the attacker's post.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS