{"id":"CVE-2026-92424","revision":"c9f8071cd7c440c49bbbc7850f86571c","records":[{"revision":"c9f8071cd7c440c49bbbc7850f86571c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92424","aliases":[],"title":"Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue","description":"The Content Egg  WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.","state":0,"publishedAt":"2026-09-30T06:00:25.073+00:00","modifiedAt":"2026-09-30T13:37:21.78+00:00","affected":[{"ecosystem":"Vendor product","name":"Content Egg","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Content Egg\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"11.9.0\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/917b8042-b38c-4b6a-9237-1dd08ada157d/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92424","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92424","identifiers":["CVE-2026-92424"]},"retained":false,"historicalAffected":[]}],"coverage":[]}