Security Advisory

CVE-2026-15233

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-04 06:00:10

Last updated 2026-08-04 17:34:29

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

← Browse all CVEs View on cve.org ↗