Stored Cross-Site Scripting Vulnerability in The Bridge WordPress Theme
CVE-2026-15609

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Bridge - Creative Multipurpose WordPress Theme
Vendor
CVE Published:
15 September 2026

What is CVE-2026-15609?

The Bridge, a popular multipurpose WordPress theme, contains a vulnerability that allows authenticated users with contributor-level access and higher to leverage the 'circle_line' shortcode attribute for Stored Cross-Site Scripting. Due to inadequate input sanitization and output escaping, attackers can inject malicious scripts into pages, which will execute whenever a user visits the compromised page. This vulnerability affects all versions up to and including 30.8.9.1. Website administrators are advised to update to the latest version to safeguard against potential exploits.

Affected Version(s)

Bridge - Creative Multipurpose WordPress Theme 0 <= 30.8.9.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://bridge.qodeinteractive.com/change-log/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro Soares de Alcântara
.