Low severity3.5NVD Advisory· Published Sep 2, 2026· Updated Sep 3, 2026
CVE-2025-15692
CVE-2025-15692
Description
The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <5.8.6
Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)Wordfence Blog · Sep 10, 2026
- WordPress Plugins: 24 Vulnerabilities Disclosed, Including Two Critical FlawsVypr Intelligence · Sep 2, 2026