EUVD-2026-52589
GHSA-6q78-rg7f-8258
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
PR:L reflects that Contributor/Author roles (lower than Editor) can exploit this under non-default but common plugin configurations, widening the attack surface beyond PR:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.
AnalysisAI
Stored cross-site scripting in the Nested Pages WordPress plugin (all versions before 3.2.15) allows authenticated users holding the Editor role - or Contributor/Author roles when the plugin is configured to manage those post types - to inject arbitrary JavaScript via unsanitized post titles that are reflected unescaped into HTML attributes on the plugin's administrative listing screen. Any higher-privileged user (including Administrators) who subsequently loads that screen will execute the attacker-controlled script within their own authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exploit exists per the WPScan advisory; the vulnerability is not listed in CISA KEV and the EPSS score is negligible (0.15%, 5th percentile), suggesting opportunistic rather than widespread active exploitation.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) describes this root cause: user-supplied post title text is written into HTML attribute contexts without proper HTML-entity encoding, allowing angle brackets, quotes, and event handler syntax to break out of the attribute and introduce executable script. The plugin (CPE: cpe:2.3:a:unknown:nested_pages:*:*:*:*:*:*:*:*) renders a hierarchical, drag-and-drop page management UI within the WordPress admin panel; post titles appear as attribute values (e.g., data-* or title= attributes) in that listing. Because the payload is stored persistently in the WordPress posts table and reflected server-side on every page load by any admin who opens the listing, this is a stored (persistent) XSS rather than a reflected or DOM-based variant. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C) captures the key mechanics: network-reachable, low complexity once access is obtained, requiring a victim admin to load the page (UI:R), and crossing a privilege boundary into the admin's browser context (S:C).
RemediationAI
Update the Nested Pages plugin to version 3.2.15 or later, which contains the vendor-released fix that properly HTML-encodes post titles before rendering them into attribute contexts. The patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/c0376718-4bea-4e1e-a76c-100799cb9b25/. As an interim compensating control where immediate patching is not possible, site administrators should audit and temporarily demote or remove any Editor, Contributor, and Author accounts held by untrusted users, since those roles are the prerequisite for exploitation; this significantly reduces the attack surface but does not eliminate the vulnerability. Administrators can also disable the Nested Pages plugin entirely until patching is feasible - the site will fall back to the native WordPress page list view with no functionality loss for front-end visitors. There is no known server-side WAF rule that reliably blocks this stored XSS variant without risk of false positives on legitimate post titles containing special characters.
More in Nested Pages
View allThe Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npB
The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,
The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `np
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nest
The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on th
The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high
The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow hig
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today