Vulnerability · Published Sep 30, 2026 · Assigned by WPScan

CVE-2026-92424Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue

Medium 6.8

In plain English

A medium-severity cross-site scripting in Content Egg from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Content Egg	0 – before 11.9.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/917b8042-b38c-4b6a-9237-1dd08ada157d/ exploit, vdb-entry, technical-description