CVE-2026-15249: Unknown Patterns Kit

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.

Affected products

• Unknown Patterns Kit: up to and including 1.0.3

Published 2026-08-12. Last modified 2026-08-26.