CVE-2026-115498 Details

A stored cross-site scripting vulnerability has been identified in the Slim Jetpack plugin for WordPress, affecting all versions through 2.7.0.1. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts into pages. These scripts execute when a user accesses the compromised page. The vulnerability exploits the 'g<PAGE_ID>-website' parameter in the contact form, taking advantage of the fact that nonce and authentication checks are only applied to logged-in users. As a result, unauthenticated visitors can inject payloads through any page that includes the [contact-form] shortcode.