CVE-2026-15233

Name of the Vulnerable Software and Affected Versions Nested Pages WordPress plugin versions prior to 3.2.15

Description Insufficient escaping of post titles before they are output into HTML attributes on an administrative listing screen allows users with the Editor role, or Contributor and Author roles when the plugin is enabled for the post type, to perform a Stored Cross-Site Scripting (XSS) attack. This enables the injection of arbitrary JavaScript that executes within the session of any higher-privileged user who views the affected screen.

Recommendations Update the plugin to version 3.2.15 or later.