CVE-2026-15249 - Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link

Back Back to CVE browser

MEDIUM

Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link

Published Aug 12, 2026

5.4

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.

Affected products

Vendor n/a Product Patterns Kit Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=1.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Patterns Kit

n/a

Version	Status	Constraints
0	affected	<=1.0.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57083
Advisory
https://wpscan.com/vulnerability/ad42fc34-5d7e-4fb9-98fc-b9e80b552535/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57083		Advisory
https://wpscan.com/vulnerability/ad42fc34-5d7e-4fb9-98fc-b9e80b552535/		exploitvdb-entrytechnical-description