CVE-2026-15234

This vulnerability in the Codeless Page Builder plugin (versions prior to 1.1.5) allows a user with contributor-level privileges to execute arbitrary JavaScript in an administrator's browser. The attack vector is a shortcode attribute that gets rendered directly as an HTML tag name rather than as content — this is the critical technical detail that makes standard content sanitization ineffective. WordPress's shortcode system was designed as a content embedding mechanism, and most plugin developers treat user input flowing through a shortcode as 'content' that will be sanitized by WordPress's output layer. This mental model is wrong when the shortcode attribute value is used to construct an HTML tag — the attribute becomes executable markup that never passes through HTML encoding. If your plugin takes a shortcode attribute like [codeless_button target='user_input'] and renders it as <a href='' id='user_input'>, you've created a direct injection point. The contributor-to-admin execution chain is the most important risk factor. A contributor cannot directly execute code, but their draft content is routinely previewed by administrators who CAN execute code. When the administrator views the contributor's draft, the malicious shortcode renders in the admin's session, executing the attacker's JavaScript with admin privileges. This inverts the typical threat model where contributor-level access is considered lower-risk. Prioritize these actions: First, determine whether this plugin is installed on any multisite network — the blast radius scales dramatically because one contributor account can target admins across hundreds of unrelated sites. Second, audit for any shortcode in your codebase that uses attribute values as HTML tag names, class names, or element IDs — the pattern is a known anti-pattern across multiple technology generations. Third, if the plugin is abandoned (the Codeless Page Builder shows signs of maintenance desert), treat it as a known malicious insertion point and remove it entirely rather than hoping for a future patch. Note that automated EPSS scanning will likely underrate this — the exploit requires a valid contributor account, which excludes script-kiddie exploitation but does not exclude insider threat. For environments with contributor accounts and admin content preview workflows, treat this as a high-severity finding regardless of EPSS scores.

Reviewed through automated stages and approved by a human before publication.