{
 "id": "WPSEC-2026-1242",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1242/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1242/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1242/index.md",
 "title": "Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Imported Post Content",
 "description": "The Content Pilot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported article titles, content and excerpts in all versions up to, and including, 2.2.4, due to insufficient input sanitization of remote content before posts are inserted. The plugin switches to the campaign author, usually an administrator with the unfiltered_html capability, before calling wp_insert_post, so the content is not filtered. This makes it possible for unauthenticated attackers who control content at a remote source used by a campaign (such as a feed) to inject arbitrary web scripts in pages that execute whenever a user accesses an imported post. Exploitation requires an administrator to have set up a campaign that imports content from a source the attacker can influence.",
 "plugin": {
  "slug": "wp-content-pilot",
  "name": "Content Pilot",
  "full_name": "Content Pilot – Autoblogging & Affiliate Marketing Suite",
  "wordpress_org": "https://wordpress.org/plugins/wp-content-pilot/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-content-pilot/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-content-pilot"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.2.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.2.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.2.5",
 "remediation": "Update to 2.2.5 or later.",
 "fix_released": "2026-10-18T06:00:09+00:00",
 "published": "2026-10-19T06:42:32+00:00",
 "updated": "2026-10-18T11:09:34.891215+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1242/",
  "https://plugins.svn.wordpress.org/wp-content-pilot/tags/2.2.5/",
  "https://wordpress.org/plugins/wp-content-pilot/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-content-pilot",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-19"
 }
}