medium5.4
CVE-2026-15249
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a …
Impact
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.
Affected products
| Product | Affected versions |
|---|---|
| Patterns Kit WordPress Plugin | through 1.0.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.