MEDIUM
pluginever
CVE published 2026-10-31
CVE-2026-111070
The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4. This is due to the plugin extracting the HTML meta description from each remotely-fetched article, piping that value through the article template substitution and html_entity_decode() in WPCP_Module::insert_post(), and then calling wp_inser [truncated]