The Nested Pages WordPress plugin before version 3.2.15 fails to properly escape post titles when they are inserted into HTML attributes on an administrative listing screen. An Editor, or a Contributor/Author when the plugin is enabled for that post type, can therefore craft a post title that contains malicious JavaScript. When a higher‑privileged user later views the listing, the script executes in the context of that user's session, potentially allowing the attacker to hijack the session, steal cookies, or perform other client‑side actions. This flaw provides a clear pathway to client‑side code execution for anyone with the appropriate roles, without the need for local privilege escalation or server‑side code execution.

WordPress sites that have the Nested Pages plugin installed with a version earlier than 3.2.15 are affected. The vulnerability applies to the plugin’s default configuration and is triggered by any user who has the Editor role or, if the plugin is enabled for the post type, a Contributor or Author role. Any installation of the plugin prior to the 3.2.15 release, regardless of site size or custom configuration, is potentially vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but its impact remains high due to the stored XSS vector. The attacker must first create a malicious post title through a legitimate role, which limits the scope to sites with users who have such permissions. Once the title is stored, any user with higher privileges who views the administrative listing will have the script executed, creating an elevated risk for administrators. The absence of a public patch or workaround further increases the urgency for remediation.