CVE-2026-15292 is a stored cross-site scripting vulnerability in the Sudoku Shortcode WordPress plugin (tibouille) affecting all versions up to 1.0.0. The flaw exists because the 'background' parameter in the 'sudoku-sc' shortcode does not properly sanitize or escape input, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of any user who views the injected page, potentially leading to session hijacking or other client-side attacks. The CVSS 3.1 base score is 6.4, reflecting medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Contributor-level or higher access can store malicious scripts via the vulnerable parameter, which execute in the browsers of users viewing the affected pages. This can lead to information disclosure or session hijacking. The vulnerability does not impact availability and requires authenticated access, limiting the attack surface.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict Contributor-level access to trusted users only and consider removing or disabling the Sudoku Shortcode plugin to prevent exploitation.