# Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via Imported Post Content

- **ID:** WPSEC-2026-1242
- **Plugin:** Content Pilot – Autoblogging & Affiliate Marketing Suite (`wp-content-pilot`), https://wordpress.org/plugins/wp-content-pilot/
- **Affected versions:** all versions before 2.2.5
- **Fixed in:** 2.2.5 (Update to 2.2.5 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-19)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-content-pilot
- **Fix released:** 2026-10-18
- **Published:** 2026-10-19
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1242/

## Description

The Content Pilot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported article titles, content and excerpts in all versions up to, and including, 2.2.4, due to insufficient input sanitization of remote content before posts are inserted. The plugin switches to the campaign author, usually an administrator with the unfiltered_html capability, before calling wp_insert_post, so the content is not filtered. This makes it possible for unauthenticated attackers who control content at a remote source used by a campaign (such as a feed) to inject arbitrary web scripts in pages that execute whenever a user accesses an imported post. Exploitation requires an administrator to have set up a campaign that imports content from a source the attacker can influence.

## References

- https://wpsec.com/vuln/WPSEC-2026-1242/
- https://plugins.svn.wordpress.org/wp-content-pilot/tags/2.2.5/
- https://wordpress.org/plugins/wp-content-pilot/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1242/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.