CVE-2026-13726

UNKNOWN 0.0

Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

Vendor	unknown
Product	mpg
Published	Jul 27, 2026

Stay Ahead of the Next One

Get instant alerts for unknown mpg

Be the first to know when new unknown vulnerabilities affecting unknown mpg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / MPG

0 < 4.1.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/4f97b6c6-c05b-4ea5-987d-d289b89cdea8/

Credits

João Ramos Maciel WPScan