CVE-2026-15273 identifies a stored XSS vulnerability in the Automatic.css WordPress plugin version 4.0.0. The flaw is due to inadequate sanitization and escaping of the REQUEST_URI input, enabling attackers without authentication to inject arbitrary web scripts. These scripts execute in the context of an administrator's browser when accessing the Activity Log settings page, potentially leading to information disclosure or session hijacking. The CVSS v3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impacts.

An unauthenticated attacker can inject malicious scripts that execute in the administrator's browser when the Activity Log settings page is accessed. This can lead to partial compromise of confidentiality and integrity, such as theft of admin session tokens or manipulation of admin interface data. There is no impact on availability. No known exploits are reported in the wild.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should limit access to the Activity Log settings page and consider additional web application firewall (WAF) rules to detect and block suspicious REQUEST_URI payloads.