CVE-2026-15609 describes a stored cross-site scripting vulnerability in the Bridge - Creative Multipurpose WordPress Theme for WordPress. The flaw exists in the handling of the 'circle_line' shortcode attribute, where input is not properly sanitized or escaped before being rendered on web pages. Authenticated attackers with contributor-level privileges or above can exploit this to inject arbitrary JavaScript code, which executes in the context of users visiting the compromised pages. This vulnerability affects all versions from 0 up to and including 30.8.9.1.

Successful exploitation allows an attacker with contributor-level access or higher to inject malicious scripts that execute in the browsers of users who view the infected pages. This can lead to theft of user credentials, session hijacking, or other actions performed with the victim's privileges. The CVSS score of 6.4 (medium severity) reflects the network attack vector, low attack complexity, and the requirement for some privileges to exploit.

No official patch or fix is currently documented for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, limit contributor-level access to trusted users only and consider removing or disabling the vulnerable shortcode if possible. Monitor for updates from QODE regarding an official remediation.