CVE-2026-15032 in Comments Plugin
Résumé
par MITRE • 07/08/2026
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.