Cross-Site Scripting Vulnerability in Patterns Kit for WordPress by PatternsKit
CVE-2026-15249
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15249?
The Patterns Kit plugin for WordPress has a vulnerability that allows users with minimal privileges, such as the Contributor role, to inject malicious payloads. This occurs because the plugin fails to properly escape link attributes before inserting them into client-side scripts. Consequently, attackers can exploit this weakness to execute code in the browsers of users who interact with the affected elements on the page. This presents significant risk to site integrity and user security if left unaddressed.
Affected Version(s)
Patterns Kit 0 <= 1.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.