CVE-2026-14835 — MEDIUM (6.8)

Vulnerability Description

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-79

References

https://wpscan.com/vulnerability/f0b869b1-ef43-4540-9ca5-4440e763d307/

FAQ

What is CVE-2026-14835?

CVE-2026-14835 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict...

How severe is CVE-2026-14835?

CVE-2026-14835 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-14835?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.