CVE-2026-15820 is a stored cross-site scripting vulnerability in the Builderall for WordPress plugin affecting all versions up to and including 3.0.2. The flaw exists in the Photo Module's 'attributes' setting, where input is not properly sanitized or escaped, allowing authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS v3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor-level or higher access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to information disclosure or session hijacking. The vulnerability does not impact availability and requires authentication, but the scope is changed as it affects other users accessing the injected content.

No official patch or remediation is currently available. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Photo Module 'attributes' setting to reduce risk.