Executive brief
The Bridge is a popular WordPress theme that allows website builders to create pages and content using shortcodes. The theme contains a stored cross-site scripting (XSS) vulnerability in the 'circle_line' shortcode that fails to properly sanitize user input. Authenticated contributors and higher-privileged users can inject malicious scripts that execute in the browsers of anyone viewing the affected pages, potentially stealing credentials, performing actions on behalf of visitors, or spreading malware.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the 'circle_line' shortcode attribute handling within The Bridge theme. The root cause is insufficient input sanitization and output escaping of shortcode parameters. The attack requires network access and authenticated user privileges at contributor level or above to inject the malicious payload via shortcode attributes on WordPress pages or posts. Once injected, the arbitrary JavaScript executes in the context of any user who visits the compromised page. The vulnerability affects all versions up to and including 30.8.9.1; a fix is available in version 30.8.9.2 released on September 11, 2026.
Affected products
- Qode Interactive The Bridge up to 30.8.9.1
Timeline
- 2026-09-15: disclosed: CVE-2026-15609 published
- 2026-09-11: patched: Fixed in The Bridge version 30.8.9.2