CVE-2026-15795 describes a stored cross-site scripting vulnerability in the Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress. The flaw arises from insufficient sanitization and escaping of shortcode attribute inputs, allowing authenticated contributors and above to inject arbitrary web scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to 3.5.3 inclusive.

An attacker with contributor-level privileges or higher can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially compromising user sessions and data confidentiality. The vulnerability does not affect availability and requires authentication with limited privileges.

No official patch or fix is currently documented. Users should upgrade beyond version 3.5.3 if a fixed version becomes available. Until then, restrict contributor-level access to trusted users only and monitor for suspicious activity. Check the vendor advisory for updates on remediation.