CVE-2026-15794 describes a stored cross-site scripting vulnerability in the Grid/List View for WooCommerce plugin for WordPress, affecting all versions up to and including 3.0.9. The issue arises from insufficient sanitization and escaping of the 'position' shortcode attribute, allowing authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript code. The shortcode attribute all_page="1" can force the widget to render on any page, broadening the scope of potential exploitation. This vulnerability can lead to script execution in the context of users visiting the injected pages.

Successful exploitation allows authenticated users with contributor-level access or above to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability affects confidentiality and integrity of user interactions but does not impact availability. The CVSS v3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Avoid using the all_page="1" shortcode attribute to limit exposure. Monitor plugin updates from the vendor and apply official patches promptly once released.