Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Imported Post Content
- ID
- WPSEC-2026-1242
- Plugin
- Content Pilot – Autoblogging & Affiliate Marketing Suite (wp-content-pilot)
- Affected
- all versions before 2.2.5
- Remediation
- Update to 2.2.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-19
- Attack surface
- Content Pilot on WPSec AttackSurface
- Fix released
- Published
Description
The Content Pilot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported article titles, content and excerpts in all versions up to, and including, 2.2.4, due to insufficient input sanitization of remote content before posts are inserted. The plugin switches to the campaign author, usually an administrator with the unfiltered_html capability, before calling wp_insert_post, so the content is not filtered. This makes it possible for unauthenticated attackers who control content at a remote source used by a campaign (such as a feed) to inject arbitrary web scripts in pages that execute whenever a user accesses an imported post. Exploitation requires an administrator to have set up a campaign that imports content from a source the attacker can influence.
References
- https://wpsec.com/vuln/WPSEC-2026-1242/
- https://plugins.svn.wordpress.org/wp-content-pilot/tags/2.2.5/
- https://wordpress.org/plugins/wp-content-pilot/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS