The Nested Pages WordPress plugin versions prior to 3.2.15 do not properly escape post titles before rendering them into HTML attributes on an administrative listing screen. This improper escaping allows users with Editor role or Contributor/Author roles (when the plugin is enabled for the post type) to inject arbitrary JavaScript code. When a higher-privileged user views the affected administrative screen, the injected script executes in their session context, resulting in a stored Cross-Site Scripting (XSS) vulnerability classified as CWE-79.

Successful exploitation could allow an attacker with Editor or Contributor/Author privileges to execute arbitrary JavaScript in the browser session of higher-privileged users (such as administrators). This could lead to session hijacking, privilege escalation, or other malicious actions performed with the victim's privileges. The CVSS score of 4.8 reflects a medium severity with low complexity and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles that can create or edit posts with the Nested Pages plugin enabled, and avoid granting Editor or Contributor/Author roles unnecessary privileges. Monitor for updates from the plugin vendor and apply the update to version 3.2.15 or later once released.