WordPress security by component

Multiple Page Generator Plugin – MPG

Plugin description

Multiple Page Generator Plugin – MPG generates multiple WordPress pages from templates and structured data using configurable content sources.

Multiple Page Generator Plugin – MPG (multiple-pages-generator-by-porthas) is a WordPress plugin with 10 published CVE records in this archive. The latest tracked vulnerability was published Sep 12, 2026; the highest published CVSS base score is 9.1.

Plugin slug: multiple-pages-generator-by-porthas

Latest vulnerability

CVE-2026-85198: MPG shortcode rendering exposes subscriber SQL injection

MPG through 4.2.1 permits SQL injection through the URL path when [mpg_spintax] is rendered in site-wide content such as a footer or template part. A subscriber can supply path data that reaches an insufficiently prepared query and extract sensitive database information. The authoritative export does not identify the query, table, or exact path segment.

PublishedSep 12, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for multiple-pages-generator-by-porthas
		Safe version
Sep 12, 2026	CVE-2026-85198 MPG shortcode rendering exposes subscriber SQL injection MPG through 4.2.1 permits SQL injection through the URL path when [mpg_spintax] is rendered in site-wide content such as a footer or template part. A subscriber can supply path data that reaches an insufficiently prepared query and extract sensitive database information. The authoritative export does not identify the query, table, or exact path segment.	See mitigation notes	CVE6.5 NVDPending
Nov 12, 2024	CVE-2024-10672 Multiple Page Generator Plugin – MPG: Arbitrary file deletion Multiple Page Generator Plugin – MPG is affected by arbitrary file deletion. Exploitation requires an authenticated editor account. A successful request can remove files outside the intended scope and may make the site unavailable.	See mitigation notes	CVE2.7 NVDPending
Nov 01, 2024	CVE-2024-7424 Multiple Page Generator Plugin – MPG: A security weakness Multiple Page Generator Plugin – MPG is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4 NVDPending
Apr 12, 2024	CVE-2024-31301 Multiple Page Generator Plugin – MPG: Cross-site request forgery Multiple Page Generator Plugin – MPG is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.4 NVD8.8
Apr 03, 2024	CVE-2024-27951 Multiple Page Generator Plugin – MPG: Dangerous file upload Multiple Page Generator Plugin – MPG is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE9.1 NVD7.2
Mar 26, 2024	CVE-2024-30235 Multiple Page Generator Plugin – MPG: A security weakness Multiple Page Generator Plugin – MPG is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVD8.8
Oct 31, 2023	CVE-2023-33927 Multiple Page Generator Plugin – MPG: SQL injection Multiple Page Generator Plugin – MPG is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.6 NVD9.8
Jun 09, 2023	CVE-2023-2607 Multiple Page Generator: SQL injection Multiple Page Generator is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE7.2 NVD7.2
May 17, 2023	CVE-2023-2608 Multiple Page Generator: SQL injection Multiple Page Generator is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE3.1 NVD4.3
Mar 14, 2023	CVE-2022-47143 Multiple Pages Generator By Porthas: Cross-site request forgery Multiple Pages Generator By Porthas is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers