CVE-2026-10089: Insert Pages WordPress Plugin Stored XSS via Meta Keys

Technical summary

CVE-2026-10089 is a Stored Cross-Site Scripting (XSS) vulnerability in the Insert Pages plugin affecting all versions through 3.11.4. The vulnerability exists in the the_meta() function, specifically at lines 1786–1791 and 1806, where custom field meta keys are directly interpolated into HTML output without escaping. While the plugin correctly sanitizes custom field values using wp_kses_post(), the key names themselves are echoed unescaped. When a page is rendered using the [insert page='ID' display='all'] shortcode, an attacker-controlled key name can inject arbitrary HTML and JavaScript. The vulnerability is classified as Stored XSS because the malicious payload persists in the WordPress database as post metadata and executes each time the affected page is accessed.

Business impact

This vulnerability could compromise the integrity of web content and user trust. An authenticated attacker could inject malicious scripts that steal session tokens, redirect visitors to phishing sites, deface page content, or harvest sensitive information from site visitors. For multi-author WordPress installations—particularly publishing platforms, agencies, and collaborative content environments—this represents a supply-chain style risk where a compromised or malicious team member can poison content at scale. The attack surface depends on how broadly author-level access is distributed within an organization.

Affected systems

The Insert Pages plugin for WordPress in all versions up to and including 3.11.4 is vulnerable. The risk is confined to WordPress installations that have the Insert Pages plugin active and in use. Exploitation requires an authenticated account with author-level permissions or above (author, editor, or administrator roles). Sites that restrict author access to a small, trusted group face lower risk than those with many content contributors.

Exploitability

Exploitability is moderate. An attacker must already possess authenticated WordPress access at the author level or higher—a non-trivial barrier that eliminates purely external attacks. However, the attack vector is network-accessible and requires no special user interaction beyond normal page visits by other site users. The CVSS score of 6.4 (Medium) reflects this: direct network access combined with authenticated scope-crossing (the attack affects other users viewing the page) but limited impact (confidentiality and integrity, not availability). Insider threat scenarios and compromised contributor accounts pose the highest risk.

Remediation

Update the Insert Pages plugin to a patched version released after July 2, 2026. Verify the specific patch version number in the official WordPress plugin repository or the vendor's security advisory. Until a patch is available, consider disabling the Insert Pages plugin if not actively required, or restrict author-level access to a minimal, trusted set of users. Additionally, audit existing custom field meta keys for any suspicious patterns that might indicate prior compromise.

Patch guidance

Check the WordPress plugin repository or the plugin vendor's website for a security update released after July 2, 2026. Apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > Insert Pages > Update). After patching, verify no new versions of the plugin are released within the next 48 hours to confirm no regression. If the plugin does not update to a version later than 3.11.4, contact the plugin maintainers for a timeline. For organizations using Software-as-a-Service WordPress hosting, coordinate with your platform provider to ensure timely patching.

Detection guidance

Search WordPress post metadata for suspicious custom field key names that contain script tags, event handlers (onclick, onerror, etc.), or encoded JavaScript. Use WordPress database queries to inspect postmeta table entries with suspicious meta_key values. Monitor access logs for pages using the [insert page] shortcode for unusual request patterns. Implement Web Application Firewall (WAF) rules to block requests containing obvious XSS payloads in parameter values. For more sophisticated detection, review page edit history in WordPress audit logs to identify when meta keys with suspicious naming patterns were created and by which user accounts.

Why prioritize this

While the CVSS score is Medium (6.4) and the vulnerability requires authenticated access, the combination of stored persistence, scope crossing, and prevalence of multi-author WordPress environments warrants timely attention. This is not a critical zero-day requiring emergency response, but it should be patched within standard maintenance windows (weeks, not months) rather than deferred. Prioritize patching if your WordPress site has more than a handful of content contributors or if you manage multiple client sites running this plugin.

Risk score, explained

The CVSS 3.1 score of 6.4 (Medium) reflects: Network-accessible attack vector, Low privilege requirements (author-level), No user interaction needed, Changed scope (malicious script affects other users, not just the attacker), and Limited impact (confidentiality and integrity compromised, but availability not affected). The score appropriately captures a real risk that can compromise user data and content integrity but stops short of critical severity because the attacker must first be authenticated and the attack only affects users viewing specific pages.

Frequently asked questions