{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acontent_eggcontent_eggwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:content_egg:content_egg:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":6.8,"id":"CVE-2026-92424"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Content Egg (\u003c 11.9.0)"],"_cs_severities":["low"],"_cs_tags":["wordpress","xss","cve-2026-92424"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eCVE-2026-92424 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Content Egg plugin for WordPress. The flaw originates from improper authorization and privilege escalation in the bulk content-import feature. When a user with contributor-level access invokes the import queue, the plugin insecurely impersonates the author of an import preset (typically an administrator) using \u003ccode\u003ewp_set_current_user()\u003c/code\u003e. This causes the post insertion process to run with the privileges of the impersonated administrator, allowing the storage of unfiltered HTML payloads.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe contributor harvests the \u003ccode\u003ecegg_import\u003c/code\u003e nonce from their own \u003ccode\u003epost-new.php\u003c/code\u003e UI.\u003c/li\u003e\n\u003cli\u003eThe contributor submits a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e with the action \u003ccode\u003ecegg_import_enqueue\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe request specifies a \u003ccode\u003epreset_id\u003c/code\u003e (created by an administrator) and a malicious JSON payload containing script tags in the title or description.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eImportQueueApi::handle_enqueue()\u003c/code\u003e function validates access as \u003ccode\u003eedit_posts\u003c/code\u003e, which the contributor possesses.\u003c/li\u003e\n\u003cli\u003eThe background worker (\u003ccode\u003eProductImportService.php\u003c/code\u003e) loads the selected preset.\u003c/li\u003e\n\u003cli\u003eThe system executes \u003ccode\u003ewp_set_current_user()\u003c/code\u003e to switch identity to the preset author (the administrator).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ewp_insert_post()\u003c/code\u003e function is called, and because the user context is now an administrator, the \u003ccode\u003eunfiltered_html\u003c/code\u003e capability allows the script tag to be stored raw.\u003c/li\u003e\n\u003cli\u003eThe script executes in the context of any administrator or editor who previews the draft, or in the browser of any visitor if the post is published.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the context of privileged users, enabling session hijacking, CSRF nonce exfiltration, account takeover, or site-wide defacement. The attack is misattributed to the impersonated administrator, complicating incident response.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the Content Egg plugin to version 11.9.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing Import Presets for unauthorized modifications or suspicious content.\u003c/li\u003e\n\u003cli\u003eAudit high-privileged user accounts for unauthorized posts or drafts created via the Content Egg plugin.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-29T21:24:45Z","date_published":"2026-10-29T21:24:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-content-egg-xss/","summary":"The Content Egg plugin for WordPress contains a stored XSS vulnerability (CVE-2026-92424) allowing contributor-level users to inject malicious scripts into posts by impersonating an administrator during the import process.","title":"Content Egg: Stored Cross-Site Scripting via Import Queue (CVE-2026-92424)","url":"https://feed.craftedsignal.io/briefs/2026-10-content-egg-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:content_egg:content_egg:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}