Executive brief
The Insert Pages plugin for WordPress, which allows users to embed content from one page into another, contains a security flaw that allows certain authorized users to inject malicious scripts. An attacker with author-level permissions or higher can save a specially crafted name for a custom data field that, when viewed by other users or administrators, executes code in their browser. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient output escaping in the the_meta() function. While the plugin sanitizes custom field values using wp_kses_post(), it fails to escape the custom field key ($key) before interpolating it into rendered HTML when using the [insert page='ID' display='all'] shortcode. An authenticated attacker with author-level permissions can exploit this by creating a post with a malicious meta key name. When the page is rendered via the shortcode, the unescaped key is echoed to the browser, allowing for the execution of arbitrary JavaScript in the context of the victim's session. A fix is available in the latest version via a changeset on the WordPress plugin repository.
Affected products
- figureone Insert Pages up to, and including, 3.11.4
Timeline
- 2026-07-02: disclosed
- 2026-07-02: advisory
References
- https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.3/insert-pages.php
- https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.3/insert-pages.php
- https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.3/insert-pages.php
- https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.4/insert-pages.php
- https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.4/insert-pages.php
- https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.4/insert-pages.php
- https://plugins.trac.wordpress.org/changeset/3579298