CVE-2026-14835
Last modified
CVE-2026-14835 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | SOGO Add Script to Individual Pages Header Footer | <= 3.9 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-14835?
How severe is CVE-2026-14835?
How do I fix CVE-2026-14835?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1483An out-of-band SQL injection vulnerability (OOB SQLi) has be…7.5
- CVE-2026-14830The FlxWoo WordPress plugin before 3.1.1 does not verify wit…7.5
- CVE-2026-14831The Easy Booking WordPress plugin before 3.5.0 does not re-e…5.3
- CVE-2026-14832The ShopSmart Loyalty for WooCommerce WordPress plugin throu…5.3
- CVE-2026-14833The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 d…6.8
- CVE-2026-14834The Mailgun for WordPress plugin before 2.2.1 does not perfo…6.5
- CVE-2026-14836The Login & Register Forms WordPress plugin before 3.2.5 do…8.1
- CVE-2026-14837Multiple Lenze products are affected by an improper signatur…8.5
- CVE-2026-14838Use of GET request method with sensitive query strings vulne…7.4
- CVE-2026-14839The Mapster WP Maps WordPress plugin before 1.24.0 does not …7.5
- CVE-2026-1484A flaw was found in the GLib Base64 encoding routine when pr…4.2
- CVE-2026-14840The YOP Poll WordPress plugin before 7.0.6 does not validate…5.3
Are you affected by CVE-2026-14835?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST