CVE-2026-15739 is a stored cross-site scripting vulnerability in the Rich Showcase for Google Reviews plugin for WordPress. The flaw exists in the handling of the 'pagination' shortcode attribute, allowing authenticated users with contributor-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 6.9.9. The CVSS 3.1 base score is 6.4, indicating a medium severity. No official patch or remediation guidance has been published at this time.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages via the 'pagination' shortcode attribute. These scripts execute in the browsers of users who view the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and requires authenticated access with low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable shortcode if possible. Monitor vendor channels for updates and apply patches promptly once released.