CVE-2026-111070 pluginever CVE debrief

Who should care

Defenders responsible for WordPress installations using the Content Pilot plugin, especially those with administrators who have configured RSS campaigns to consume content from untrusted sources, should assess exposure and prioritize verification and remediation.

Why it matters

The Content Pilot plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying exposure and remediation, especially for WordPress installations with untrusted RSS sources.

• Unauthenticated attackers can inject arbitrary web scripts in pages
• Injected scripts can execute on the front end when users access injected pages
• Defenders must verify exposure of WordPress installations using the Content Pilot plugin
• Remediation priority is high for WordPress installations with untrusted RSS sources

Technical summary

The Content Pilot plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient sanitization of attacker-controlled HTML. An unauthenticated attacker who controls the content of any RSS source an administrator has configured a Content Pilot RSS campaign to consume can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin extracts the HTML meta description from each remotely-fetched article, pipes that value through the article template substitution and html_entity_decode() in WPCP_Module::insert_post(), and then calls wp_insert_post() after switching the current user to the configured campaign author — so no wp_kses_post sanitizatio

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Content Pilot plugin, especially if administrators have configured RSS campaigns to consume content from untrusted sources.

Recommended defensive actions

• Verify WordPress installations for the Content Pilot plugin version 2.2.4 or earlier
• Check if administrators have configured RSS campaigns to consume content from untrusted sources
• Consider upgrading to a patched version of the Content Pilot plugin
• Monitor for suspicious activity on WordPress installations using the Content Pilot plugin
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including the affected plugin version and the lack of sanitization applied to attacker-controlled HTML. The Content Pilot plugin for WordPress extracts the HTML meta description from each remotely-fetched article and pipes that value through the article template substitution and html_entity_decode() in WPCP_Module::insert_post(). No wp_kses_post sanitization is applied to the attacker-controlled HTML before it is persisted as post_content and rendered on the front end.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.