CVE-2026-10089

The Insert Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post custom field keys (meta key names) in all versions up to, and including, 3.11.4. This is due to insufficient output escaping in the the_meta() function: while the custom field VALUE is sanitized with wp_kses_post(), the custom field KEY ($key) is interpolated into the rendered HTML (lines 1786-1791) and echoed (line 1806) without any escaping when an inserted page is rendered with the [insert page='ID' display='all'] shortcode. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.3/insert-pages.php#L1771
• https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.3/insert-pages.php#L1789
• https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.3/insert-pages.php#L768
• https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.4/insert-pages.php#L1771
• https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.4/insert-pages.php#L1789
• https://plugins.trac.wordpress.org/browser/insert-pages/tags/3.11.4/insert-pages.php#L768
• https://plugins.trac.wordpress.org/changeset/3579298
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a4246181-d331-46b0-ad48-e2ece11b2f5f?source=cve

Published

Jul 2, 2026

Last Modified

Jul 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100884A vulnerability has been found in Krayin laravel-crm up to 2…4.3
• CVE-2026-100885A vulnerability was found in Krayin laravel-crm up to 2.2.4.…7.3
• CVE-2026-100886A vulnerability was identified in Seetong T8108, T8108P, T81…10
• CVE-2026-100887A security flaw has been discovered in amirsanni Mini-Invent…6.3
• CVE-2026-100888A weakness has been identified in Trusted Domain Project Ope…7.3
• CVE-2026-100889A vulnerability was detected in Trusted Domain Project OpenD…7.3
• CVE-2026-100890A flaw has been found in Trusted Domain Project OpenDMARC up…5.3
• CVE-2026-100891A vulnerability has been found in Trusted Domain Project Ope…7.3
• CVE-2026-100892A vulnerability was found in aligungr UERANSIM up to 3.3.0. …5.3
• CVE-2026-100893A vulnerability was determined in Privoce VoceChat Server up…7.3
• CVE-2026-100894A vulnerability was identified in mathurvishal CloudClassroo…6.3
• CVE-2026-100895A security flaw has been discovered in Trusted Domain Projec…5.3