What is CVE-2026-15249?
CVE-2026-15249 is a Stored XSS vulnerability in the Patterns Kit WordPress plugin up to version 1.0.3, caused by improper escaping of a link attribute before client-side insertion. It allows users with Contributor-level permissions to inject a malicious payload that executes in the browser of anyone viewing and clicking the affected content.
Azərbaycanca: CVE-2026-15249 Patterns Kit WordPress plugin-in 1.0.3-ə qədər versiyalarında link atributunun düzgün escape edilməməsi nəticəsində yaranan Stored XSS zəifliyidir. Bu zəiflik Contributor kimi aşağı səlahiyyətli istifadəçilərə zərərli JavaScript yükü yerləşdirməyə imkan verir. Plugin-i ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
What level of user permission is required to exploit CVE-2026-15249?
Low-privileged user permissions, such as those of a Contributor, are sufficient to exploit this vulnerability.
Which versions of the Patterns Kit plugin are affected by the CVE-2026-15249 Stored XSS vulnerability?
Plugin versions up to 1.0.3 are affected by this vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.