Stored Cross-Site Scripting in Voyage Plus Plugin for WordPress

CVE-2026-5715

What is CVE-2026-5715?

The Voyage Plus plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability originating from inadequate input sanitization and output escaping on user-supplied attributes within the 'post-content' shortcode's 'class' attribute. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts. The injected scripts can execute whenever a user accesses the compromised pages, potentially leading to the disclosure of sensitive information or further exploitation of the site.

References