CVE-2026-5715 is a stored cross-site scripting vulnerability in the Voyage Plus WordPress plugin, specifically affecting the 'class' attribute of the 'post-content' shortcode. The plugin fails to properly sanitize and escape user input, allowing authenticated contributors or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges at contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact. No official patch or remediation guidance is currently available.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the browsers of users who view the infected pages, potentially compromising user sessions or data confidentiality and integrity. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Voyage Plus plugin if possible to prevent exploitation.