CVE-2026-15609: Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated with at least Contributor-level access. They can inject script through the circle_line shortcode attribute.
Which installations are affected?
All versions of the Bridge - Creative Multipurpose WordPress Theme through 30.8.9.1 are affected. The provided information does not identify any configuration prerequisite beyond use of the affected theme and shortcode.
What is the impact after successful exploitation?
Injected scripts are stored in a page and execute when a user visits that page. The vulnerability is rated medium severity with low confidentiality and integrity impact and no availability impact.