CVE-2026-14835CWE-79cross-site-scripting

CVE-2026-14835

Medium · published August 30, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00229 · 12.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-30T11:17Z
References (1)
https://wpscan.com/vulnerability/f0b869b1-ef43-4540-9ca5-4440e763d307/ · [email protected]
EPSS history
Timeline
  • 30 AUG 16:16Z
    EPSS moved — → 0%
    epss
  • 30 AUG 06:00Z
    SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
    cvelistv5