CVE-2026-15394 describes a stored Cross-Site Scripting vulnerability in the Header Footer Script Adder plugin for WordPress by mahethekiller. The flaw exists in the handling of the 'asm_code' Snippet Meta, allowing authenticated users with author-level privileges or above to inject arbitrary web scripts. These scripts are stored and executed when any user accesses the injected page. The vulnerability is due to insufficient sanitization of input and lack of proper output escaping. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the author level. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated author or higher to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no direct impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider removing or disabling the plugin if possible to mitigate risk.