WordPress security by component
Content Egg
Plugin description
Content Egg aggregates and displays content such as products, deals, feeds, and related information in WordPress.
Content Egg (content-egg) is a WordPress plugin with 8 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; the highest published CVSS base score is 8.1.
Plugin slug:
content-eggLatest vulnerability
CVE-2026-119087: Content Egg – Affiliate Product Importer & Price Comparison: Unauthorized post attribution
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned preset_id, causing wp_insert_post to record the administrator as post_author. This includes the ability to create published posts when the attacker already holds publish_posts capability for the preset's post type, resulting in administrator-attributed published content created by a lower-privileged user. The structured affected range is <= 12.0.0.
| Safe version |
|
||
|---|---|---|---|
| Oct 30, 2026 |
CVE-2026-119087
Content Egg – Affiliate Product Importer & Price Comparison: Unauthorized post attribution
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned preset_id, causing wp_insert_post to record the administrator as post_author. This includes the ability to create published posts when the attacker already holds publish_posts capability for the preset's post type, resulting in administrator-attributed published content created by a lower-privileged user. The structured affected range is <= 12.0.0.
|
See mitigation notes |
CVE4.3
|
| Oct 30, 2026 |
CVE-2026-119059
Content Egg – Affiliate Product Importer & Price Comparison: Unauthorized cross-post product updates
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on arbitrary posts, including those owned by administrators. The structured affected range is <= 12.0.0.
|
See mitigation notes |
CVE4.3
|
| Sep 30, 2026 |
CVE-2026-96832
Content Egg: PHP object injection
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions. This class of flaw permits attacker-influenced serialized data to instantiate PHP objects. File operations or code execution depend on a usable object/gadget chain; no such chain is identified here. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 11.9.0.
|
11.9.0 |
CVE7.2
|
| Sep 30, 2026 |
CVE-2026-92424
Content Egg: Contributor imports execute under a privileged preset author's identity
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content. The authoritative export identifies the fixed release as 11.9.0.
|
11.9.0 |
CVE6.8
|
| Aug 05, 2026 |
CVE-2026-15979
Content Egg Authors can traverse paths and delete server files
Content Egg through 11.3.0 allows an Author or higher role to place an attacker-controlled img_file path in cegg_data while editing a post. EggMetabox::saveMeta() verifies the normal Content Egg nonce and the user's edit_post or edit_page capability, but ContentManager::dataPresavePrepare() applies only wp_strip_all_tags() before storing the value in _cegg_data_
|
11.4.0 |
CVE8.1
|
| Aug 14, 2025 |
CVE-2025-47536
Content Egg: Code execution
Content Egg is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE7.2
|
| Nov 03, 2022 |
CVE-2022-25952
Content Egg: Cross-site request forgery
Content Egg is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
|
| May 02, 2022 |
CVE-2022-0428
Content Egg: Cross-site scripting
Content Egg is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVEPending
|