CVE-2026-92424
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
- Published
- Sep 30, 2026
- Updated
- Sep 30, 2026
- Assigning CNA
- WPScan
- Evidence observed
- Nov 4, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 13.8%
- Model date
- Nov 4, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.
Sources
Advisory and proof-of-concept for CVE-2026-92424, a Contributor-level stored XSS in the Content Egg WordPress plugin that impersonates an admin before inserting posts.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.