CVE-2026-15233

The CVE concerns the Nested Pages WordPress plugin before 3.2.15. The vulnerability arises when post titles are output into HTML attributes on an administrative listing screen without proper escaping, enabling stored XSS. An attacker with Editor privileges (or lower, given the plugin’s configurat...