CVE-2026-15889 is a stored cross-site scripting vulnerability in the Aruba HiSpeed Cache WordPress plugin. The flaw exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of post content. Authenticated attackers with Contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the injected pages. The vulnerability affects all versions up to and including 3.0.14. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level. No official patch or remediation guidance is currently available.

An attacker with Contributor-level or higher access can inject malicious scripts into post content that execute in the browsers of users who view the compromised pages. This can lead to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider additional content filtering or security plugins to mitigate script injection risks.