CVE-2026-15233

MediumCVSS 4.8

Published: 04/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen. This allows users with the Editor role (or Contributor/Author when enabled) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

Risk Assessment

The risk is session hijacking of administrators or other privileged users, potentially leading to full site compromise.

Recommendation

Update the Nested Pages plugin to version 3.2.15 or later, and restrict roles that can edit post titles.

Other vulnerabilities in Nested Pages

CVE-2026-100512Critical
PHP Object Injection vulnerability in Nested Pages plugin up to version 3.3.2. Allows an attacker to inject malicious PHP objects.

Original NVD description (English source)

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS