CVE-2026-15032

MediumCVSS 6.1

Published: 07/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The Comments WordPress plugin before version 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.

Risk Assessment

An attacker can steal administrator data, hijack sessions, or perform other malicious actions in the victim's browser context, potentially leading to site compromise.

Recommendation

Update the Comments plugin to version 7.6.60 or later. Additionally, implement Content Security Policy (CSP) and sanitize input.

Other vulnerabilities in Comments WordPress plugin

CVE-2026-19704Medium
The Comments WordPress plugin before version 7.6.66 does not validate a value used to build a database query. This allows unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

Original NVD description (English source)

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS