Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-15233 Stored Cross-Site Scripting in Nested Pages WordPress Plugin Before 3.2.15 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15233
Post summary
The entry announces CVE-2026-15233, detailing a stored XSS vulnerability affecting the WordPress Nested Pages plugin prior to v3.2.15, but it does not provide a proof of concept or exploit specifics.