← CVE Intelligence

CVE-2026-15249

Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link PUBLISHED

Description (CNA)

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.

Affected (CNA)

Vendor / productVersions
Unknown / Patterns Kitaffected 0 through 1.0.3

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.