---
title: "Themeisle multiple page generator vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/themeisle/multiple-page-generator
type: product
description: "Themeisle multiple page generator has 11 published CVEs, 0 in CISA KEV and 0 with public exploits."
updated: 2026-10-29
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Themeisle multiple page generator vulnerabilities

Vendor: [Themeisle](https://radicalnotion.ai/vendor/themeisle)

- **Published CVEs:** 11
- **In CISA KEV:** 0
- **With a public exploit:** 0
- **With a patch:** 11
- **Average CVSS:** 7.4
- **First CVE:** 2023-03-14
- **Latest CVE:** 2026-10-29

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 2 |
| High | 6 |
| Medium | 2 |
| Low | 1 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 3 |
| [CWE-73](https://radicalnotion.ai/cwe/cwe-73) | External Control of File Name or Path | 1 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 1 |
| [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 1 |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 1 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2023 | 4 |
| 2024 | 5 |
| 2025 | 1 |
| 2026 | 1 |

## Affected versions

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 3.4.1 | range | 3 |
| \< 3.3.18 | range | 1 |
| \< 3.4.8 | range | 1 |
| \< 4.0.3 | range | 1 |
| \< 4.0.6 | range | 1 |
| \< 4.2.5 | range | 1 |
| \<= 3.3.17 | range | 1 |
| \<= 3.3.19 | range | 1 |
| \<= 3.3.9 | range | 1 |
| \<= 3.4.0 | range | 1 |
| 3.4.1 | patched | 3 |
| 3.3.18 | patched | 1 |
| 3.4.8 | patched | 1 |
| 4.0.3 | patched | 1 |
| 4.0.6 | patched | 1 |
| 4.2.5 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-119054 | Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url | medium | 5.1 | No | No | Yes |
| CVE-2024-10705 | Multiple Page Generator Plugin – MPG \<= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl | high | 8.1 | No | No | Yes |
| CVE-2024-10672 | Multiple Page Generator Plugin – MPG \<= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion | low | 2.7 | No | No | Yes |
| CVE-2024-47325 | WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.7 - SQL Injection vulnerability | high | 8.8 | No | No | Yes |
| CVE-2024-31301 | WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.0 - Cross Site Request Forgery (CSRF) vulnerability | high | 8.8 | No | No | Yes |
| CVE-2024-27951 | WordPress Multiple Page Generator Plugin \<= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability | critical | 9.1 | No | No | Yes |
| CVE-2024-30235 | WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.0 - Broken Access Control vulnerability | high | 8.8 | No | No | Yes |
| CVE-2023-33927 | WordPress Multiple Page Generator Plugin – MPG Plugin \<= 3.3.19 is vulnerable to SQL Injection | critical | 9.8 | No | No | Yes |
| CVE-2023-2607 | Multiple Page Generator Plugin \<= 3.3.17 - Authenticated (Administrator+) SQL Injection | high | 7.2 | No | No | Yes |
| CVE-2023-2608 | Multiple Page Generator Plugin \<= 3.3.17 - Cross-Site Request Forgery to SQL Injection | medium | 4.3 | No | No | Yes |
| CVE-2022-47143 | WordPress Multiple Page Generator Plugin – MPG Plugin \<= 3.3.9 is vulnerable to Cross Site Request Forgery (CSRF) | high | 8.8 | No | No | Yes |

## Frequently asked questions

### How many CVEs does Themeisle multiple page generator have?

Themeisle multiple page generator has 11 published CVE records since 2023.

### How many Themeisle multiple page generator CVEs are in CISA KEV?

None of Themeisle multiple page generator's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Themeisle multiple page generator vulnerabilities?

No Themeisle multiple page generator CVEs currently have a tracked public exploit in this dataset.

### Which versions of Themeisle multiple page generator are affected?

16 distinct Themeisle multiple page generator versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Themeisle multiple page generator CVEs?

Themeisle multiple page generator's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-73 (External Control of File Name or Path), CWE-862 (Missing Authorization).

### How many critical Themeisle multiple page generator vulnerabilities are there?

Themeisle multiple page generator has 2 critical and 6 high-severity CVEs.

### What is the average severity of Themeisle multiple page generator CVEs?

The average CVSS base score across Themeisle multiple page generator's scored CVEs is 7.4.

## Other products from this vendor

- [RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy-feed-to-post-autoblogging-news-and-youtube-video-feeds-aggregator) (17 CVEs)
- [orbit fox](https://radicalnotion.ai/vendor/themeisle/orbit-fox) (15 CVEs)
- [Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More](https://radicalnotion.ai/vendor/themeisle/orbit-fox-duplicate-page-menu-icons-svg-support-cookie-notice-custom-fonts-and-more) (14 CVEs)
- [Multiple Page Generator Plugin – MPG](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator-plugin-mpg) (11 CVEs)
- [Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE](https://radicalnotion.ai/vendor/themeisle/otter-blocks-gutenberg-blocks-page-builder-for-gutenberg-editor-and-fse) (11 CVEs)
- [otter blocks](https://radicalnotion.ai/vendor/themeisle/otter-blocks) (10 CVEs)
- [Redirection for Contact Form 7](https://radicalnotion.ai/vendor/themeisle/redirection-for-contact-form-7) (9 CVEs)
- [rss aggregator by feedzy](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy) (9 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.