Executive brief
The Nested Pages WordPress plugin fails to properly escape post titles before displaying them in the admin listing screen. An attacker with Editor role (or Contributor/Author if enabled for that post type) can craft a malicious post title containing JavaScript that executes in the browser of any higher-privileged administrator viewing the list, potentially allowing account takeover or unauthorized actions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Nested Pages WordPress plugin before version 3.2.15. The vulnerable component is the admin listing screen that displays post titles without proper HTML escaping when rendering them into HTML attributes. An authenticated user with Editor role (or Contributor/Author when the plugin is enabled for their post type) can inject arbitrary JavaScript by crafting a post title with special characters and event handlers (e.g., z" onmouseover="alert(document.domain)" x=). When a higher-privileged user (Administrator or Super Admin) views the Nested Pages admin screen at /wp-admin/admin.php?page=nestedpages, the unescaped payload executes in their session. The vulnerability is fixed in version 3.2.15.
Affected products
- Nested Pages Nested Pages before 3.2.15
Timeline
- 2026-07-27: disclosed
- 2026-08-04: advisory
- 2026-07-27: patched: Fixed in version 3.2.15