Description

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpagery_add_filter_text_template_post() function, which is hooked to admin_footer and echoes the raw post_title of the post referenced by the ?lpagery_template query parameter directly inside a JavaScript single-quoted string literal, without esc_js(), esc_html(), or any other encoding. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher-privileged user (such as an administrator) accesses an admin page with the ?lpagery_template=<post_id> parameter pointing at the attacker's post.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-07-23T10:16:50.560Z",
  "pubdate": "2026-07-23T10:16:50.560Z",
  "executiveSummary": "The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This security flaw stems from insufficient input sanitization and inadequate output escaping within the codebase. The vulnerability allows authenticated attackers possessing Contributor-level access and above to inject arbitrary web scripts into post titles. These malicious scripts are subsequently stored and executed within the administrative context when a higher-privileged user, such as an administrator, accesses specific plugin functionality. The primary risk implication of this vulnerability is the potential complete compromise of administrative sessions, privilege escalation, or unauthorized modification of site content through the execution of arbitrary JavaScript in the victim's browser context. Exploitation requires authenticated access with specific capability thresholds and necessitates social engineering or targeted navigation by a privileged user to the crafted URL containing the malicious query parameters.",
  "technicalDetails": "The root cause of this vulnerability is improper output neutralization within the lpagery_add_filter_text_template_post() function. This function is hooked to the WordPress admin_footer action hook, ensuring its execution during the rendering of administrative pages. Within this function, the raw post_title of a post referenced by the ?lpagery_template query parameter is echoed directly inside a JavaScript single-quoted string literal. The application fails to apply context-aware escaping mechanisms, such as esc_js() or esc_html(), leaving the output entirely unescaped.\nThe vulnerable component resides in the Lpagery plugin code handling template post references, specifically in versions up to, and including, 2.5.7. Network exposure is restricted to the WordPress administrative dashboard, requiring the target to be authenticated. However, the authentication requirement is minimal, as attackers need only Contributor-level access to create or modify post titles.\nThe attack flow proceeds as follows: First, an authenticated attacker with Contributor-level access crafts a malicious post title containing arbitrary JavaScript payloads designed to break out of the JavaScript single-quoted string literal context. Second, the attacker induces a higher-privileged user, such as an administrator, to navigate to an administrative page initialized with the specific query parameter ?lpagery_template=<post_id>, where the post ID points to the attacker-controlled post. Third, when the administrative page renders, the lpagery_add_filter_text_template_post() function retrieves the raw post title and injects it directly into the footer script block. Finally, the browser of the higher-privileged user parses and executes the injected script within the context of the WordPress admin session, achieving stored cross-site scripting."
}