The Bulk Page Generator plugin allows an authenticated user with Contributor access or higher to store arbitrary JavaScript in a post title. The vulnerability exists because the lpagery_add_filter_text_template_post() function echoes the raw post_title inside a JavaScript single‑quoted string literal without proper escaping or sanitization. When a higher‑privileged user visits an admin page with the ?lpagery_template=<post_id> parameter pointing at the malicious post, the injected script runs in that user’s browser context, allowing the attacker to steal session cookies, deface content, or perform other malicious actions.

The affected product is Bulk Page Generator – LPagery by niklaslindemann, with all releases up to and including 2.5.7 vulnerable. Earlier versions are not affected.

The CVSS score is 6.4, reflecting a moderate severity. The EPSS score of <1 % indicates a very low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the Contributor level or above, but once a malicious post exists it will affect any administrator or higher‑privileged user who accesses the admin interface with the corresponding query parameter.