CVE-2026-15759 is a stored cross-site scripting vulnerability in the themeatelier ChatHelp WordPress plugin (all versions up to 3.5.1). It results from improper neutralization of input in the 'number' and 'group' shortcode attributes, allowing authenticated users with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has no confirmed patch or official remediation at this time.

An attacker with contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages using the vulnerable shortcode attributes. These scripts execute in the browsers of users who visit the affected pages, potentially leading to theft of sensitive information, session tokens, or other malicious actions within the context of the victim's session. There is no indication of impact to availability. The vulnerability requires authenticated access and does not involve user interaction to trigger the script execution once the page is loaded.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply any official patches promptly once released.