Nested Pages < 3.2.15 – Editor+ Stored XSS via Post Title | CVE 2026-15233

Description

The plugin does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the plugin is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.

Proof of Concept

Prerequisite: WordPress Multisite (so Editors lack the unfiltered_html capability), Nested Pages <= 3.2.13 active. The attacker holds the Editor role.

1. As an Editor, add a new Page using the standard WordPress editor with this exact title:

   z" onmouseover="alert(document.domain)" x=

2. An Administrator (or network Super Admin) opens the Nested Pages screen:

   /wp-admin/admin.php?page=nestedpages

3. The title is echoed unescaped into double-quoted HTML attributes on the row, breaking out of the attribute and injecting a live event handler. Hovering the injected row element runs alert(document.domain) in the Administrator's session.