CVE-2026-15233 is a Cross-Site Scripting vulnerability in the Nested Pages WordPress plugin prior to version 3.2.15. The vulnerability arises because post titles are not properly escaped before being output into HTML attributes on an administrative listing screen. This improper sanitization enables users with Editor privileges (or Contributor/Author roles under certain plugin configurations) to inject malicious JavaScript code. When a user with higher privileges accesses the affected administrative screen, the injected script executes in their session context, potentially leading to session hijacking or other malicious actions.

An attacker with Editor, Contributor, or Author privileges can inject arbitrary JavaScript code that executes in the browser session of higher-privileged users viewing the administrative listing screen. This can lead to unauthorized actions performed with elevated privileges, session compromise, or other attacks facilitated by script execution in a trusted context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of Editor, Contributor, and Author roles to trusted users only. Monitor for updates from the plugin vendor regarding a security patch for version 3.2.15 or later.