CVE-2026-15404 describes a stored Cross-Site Scripting vulnerability in the LPagery plugin for WordPress. The issue occurs because the function lpagery_add_filter_text_template_post(), hooked to admin_footer, outputs the raw post_title referenced by the ?lpagery_template query parameter directly inside a JavaScript single-quoted string literal without proper escaping functions such as esc_js() or esc_html(). This allows authenticated attackers with Contributor-level permissions or above to inject arbitrary JavaScript code that executes in the context of higher-privileged users (e.g., administrators) when they access an admin page with the crafted parameter.

An attacker with Contributor-level access or higher can inject persistent malicious scripts into post titles. These scripts execute in the browsers of higher-privileged users who view the affected admin pages, potentially leading to session hijacking, privilege escalation, or other malicious actions within the WordPress admin context. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity), indicating a moderate risk with network attack vector, low attack complexity, and no user interaction required.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and avoid visiting admin pages with the ?lpagery_template query parameter referencing untrusted posts. Monitor vendor channels for updates and apply official fixes once released.