CVE-2026-15233
Received Received - Intake

Reflected XSS in Nested Pages WordPress Plugin

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: WPScan

Description
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-15233
EUVD
EUVD-2026-52589

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nested_pages plugin to 3.2.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Nested Pages WordPress plugin before version 3.2.15. It fails to properly escape post titles when displaying them in HTML attributes on an admin screen. This allows users with Editor role (or Contributor/Author for certain post types) to inject malicious JavaScript code.

Detection Guidance

Check if the Nested Pages WordPress plugin version is below 3.2.15 by inspecting the plugin files or WordPress admin panel. Look for unusual JavaScript execution in administrative screens where post titles are displayed.

Impact Analysis

An attacker with Editor role or lower could inject JavaScript that executes when a higher-privileged user views the affected admin screen. This could lead to session hijacking, unauthorized actions, or data theft by the attacker.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations using the vulnerable plugin may face compliance violations and potential fines.

Mitigation Strategies

Update the Nested Pages plugin to version 3.2.15 or later immediately. If updating is not possible, consider disabling the plugin temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart