Content Egg Vulnerabilities

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'img_file' field within the cegg_data post metadata: the value passes only through wp_str...

CVSS:

8.1

Affected:

up to 11.3.0

Fixed in:

11.4.0

Disclosed:

Aug 4, 2026

CVE-2026-15979 on NVD →

The Content Egg plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 7.0.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable softw...

CVSS:

6.6

Affected:

up to 7.0.0

Fixed in:

8.0.0

Disclosed:

Jul 30, 2025

CVE-2025-47536 on NVD →

The Content Egg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.0. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke that function, via forged request granted they can trick...

CVSS:

8.8

Affected:

up to 5.4.0

Fixed in:

5.5.0

Disclosed:

Oct 31, 2022

CVE-2022-25952 on NVD →

The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 5.3.0

Fixed in:

5.3.0

Disclosed:

Apr 6, 2022

CVE-2022-0428 on NVD →