CVE-2026-5715 is a stored cross-site scripting vulnerability in the Voyage Plus WordPress plugin, affecting all versions up to and including 1.0.6. The flaw exists because the plugin does not properly sanitize or escape user input in the 'class' attribute of the 'post-content' shortcode, allowing authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code. This malicious code executes in the context of users who view the compromised pages, potentially leading to session hijacking or other client-side impacts. The vulnerability has a CVSS 3.1 score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. No official fix or patch has been published by the vendor as of the information provided.

An authenticated attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions or data confidentiality and integrity. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the Voyage Plus plugin if feasible. Monitor for updates from the vendor regarding patches or official mitigations.