The Multiple Page Generator (MPG) WordPress plugin before version 4.1.8 contains a reflected cross‑site scripting flaw. A parameter supplied through the mpg_shortcode is not properly sanitized or escaped before it is echoed back to the browser, enabling an attacker to inject arbitrary script code into the page. The affected code path allows the attacker to exploit the flaw via a crafted HTTP request, resulting in client‑side attacks against any visitor who follows a malicious link.

WordPress sites running the MPG plugin with any release earlier than 4.1.8 are vulnerable. The flaw exists in the plugin’s shortcode handling and does not rely on specific server configurations beyond the presence of the plugin.

The vulnerability receives a CVSS score of 7.1, indicating a high potential impact. The EPSS score of <1% highlights a very low likelihood of exploitation, and the flaw is not listed in CISA’s KEV catalog. Attackers can exploit the flaw without authentication by tricking users into opening a crafted URL, making it feasible in typical social engineering scenarios. The primary consequence is the execution of unintended JavaScript in the victim’s browser, which can lead to data theft, cookie hijacking, or further network compromise.