Content Egg: Stored Cross-Site Scripting via Import Queue (CVE-2026-92424)

CVE-2026-92424 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Content Egg plugin for WordPress. The flaw originates from improper authorization and privilege escalation in the bulk content-import feature. When a user with contributor-level access invokes the import queue, the plugin insecurely impersonates the author of an import preset (typically an administrator) using wp_set_current_user(). This causes the post insertion process to run with the privileges of the impersonated administrator, allowing the storage of unfiltered HTML payloads.

Attack Chain

1. The contributor harvests the cegg_import nonce from their own post-new.php UI.
2. The contributor submits a POST request to wp-admin/admin-ajax.php with the action cegg_import_enqueue.
3. The request specifies a preset_id (created by an administrator) and a malicious JSON payload containing script tags in the title or description.
4. The ImportQueueApi::handle_enqueue() function validates access as edit_posts, which the contributor possesses.
5. The background worker (ProductImportService.php) loads the selected preset.
6. The system executes wp_set_current_user() to switch identity to the preset author (the administrator).
7. The wp_insert_post() function is called, and because the user context is now an administrator, the unfiltered_html capability allows the script tag to be stored raw.
8. The script executes in the context of any administrator or editor who previews the draft, or in the browser of any visitor if the post is published.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of privileged users, enabling session hijacking, CSRF nonce exfiltration, account takeover, or site-wide defacement. The attack is misattributed to the impersonated administrator, complicating incident response.

Recommendation

1. Upgrade the Content Egg plugin to version 11.9.0 or later immediately.
2. Audit existing Import Presets for unauthorized modifications or suspicious content.
3. Audit high-privileged user accounts for unauthorized posts or drafts created via the Content Egg plugin.