What is CVE-2026-15233?

CVE-2026-15233 is a medium-severity vulnerability in Nested Pages, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2026-08-04.

How severe is CVE-2026-15233?

Medium severity. CVSS v3 base score is 4.8 out of 10.

XSS in Nested Pages

CVE-2026-15233

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Neste…

Vulnerability class: XSS (Cross-Site Scripting)

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.

Affected products

Unknown Nested Pages — versions 0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-15233?: CVE-2026-15233 is a medium-severity vulnerability in Nested Pages, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2026-08-04.
How severe is CVE-2026-15233?: Medium severity. CVSS v3 base score is 4.8 out of 10.