CVE-2026-15249
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page. Users with a role as low as Contributor can store a payload that executes in the browser of a user who views the content and clicks the affected element.
Risk Assessment
Risk of XSS attacks that can lead to session theft, account takeover, or spreading malicious code among visitors.
Recommendation
Update the Patterns Kit plugin to a version newer than 1.0.3. Restrict roles that can publish content and consider adding security headers.
Original NVD description (English source)
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.