XSS Vulnerability in Nested Pages WordPress Plugin Affects Administrators
CVE-2026-15233

Currently unrated

Key Information:

Vendor

WordPress
Status
Nested Pages
Vendor
CVE Published:
4 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15233?

The Nested Pages plugin for WordPress prior to version 3.2.15 contains a vulnerability where post titles are not properly escaped before being rendered into HTML attributes. This oversight allows users with roles such as Editor, Contributor, or Author to inject arbitrary JavaScript into the admin listing screen. When higher-privileged users view this screen, the injected JavaScript executes in their session, potentially compromising user data and security.

Affected Version(s)

Nested Pages 0 < 3.2.15

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15233 - Proof of Concept

References

https://wpscan.com/vulnerability/c0376718-4bea-4e1e-a76c-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Meher Sudhakar Abbireddi
WPScan
.