Security Advisory

CVE-2026-14835

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-30 06:00:17

Last updated 2026-08-31 12:38:06

Assigner WPScan

CVSS score 6.8

State PUBLISHED

Description

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.

← Browse all CVEs View on cve.org ↗