CVE-2026-15032 is a CWE-79 Cross-Site Scripting vulnerability in the Comments WordPress plugin prior to version 7.6.60. The flaw arises because the plugin fails to properly escape user-supplied URLs before embedding them in HTML attributes, enabling unauthenticated attackers to inject persistent XSS payloads. When other users, including administrators, view the affected content, the malicious script executes in their browsers. This vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no impact on availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to inject persistent cross-site scripting payloads that execute in the browsers of users who view the affected comments, potentially leading to theft of sensitive information or session hijacking. The impact affects confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with comments and consider applying temporary mitigations such as disabling the vulnerable plugin or restricting comment submissions. Monitor official vendor channels for updates and patches.