The CVSS 6.8 rating fundamentally mischaracterizes CVE-2026-15047. The score anchors on contributor-level access as if that privilege boundary contains the blast radius—but this is stored XSS executing in inline script contexts, which means every visitor of every post containing the poisoned shortcode becomes a victim automatically. No social engineering, no clicking required. A contributor cannot publish directly, but they can save a post with a malicious shortcode that fires against every subsequent viewer, including administrators reviewing that post in the dashboard.
The 'several shortcode attributes' phrasing in the disclosure signals something more concerning than a single missed escaping call. This language indicates developers were outputting user-controlled values into JavaScript contexts without context-aware encoding like wp_json_encode()—applying esc_html() or esc_attr() (appropriate for HTML) into script tags where JavaScript string encoding is required. If multiple attributes show this pattern, it points to a systemic templating failure across the plugin, not an isolated oversight.
The propagation mechanics extend well beyond the published page. WordPress syndicates content through REST API endpoints, RSS feeds, and email notification systems—each of which may execute the payload in contexts with different sandboxing than a browser. Administrators opening posts in the dashboard are high-value targets. Automated systems consuming content programmatically often lack browser sandboxing entirely.
The critical action most defenders will miss: version 260805 fixes the injection vector going forward, but poisoned posts already in the database remain active. The patch does not disinfect existing content. Any post created between the vulnerability's introduction and the patch contains a stored payload that will execute on every future viewer. If your installation had this plugin installed for months or years before updating, audit your database for posts containing shortcodes from this plugin. Consider whether content migrations, backups, or staging-to-production syncs may have carried payloads into environments where the fix isn't yet applied.
The 'several attributes' finding also suggests other plugins using similar shortcode boilerplate patterns may carry the same vulnerability. If this was caught in code review rather than active exploitation, the same failure mode likely exists elsewhere in the WordPress plugin ecosystem.