CVE-2026-14203
Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jul 27, 2026
- Updated
- Jul 27, 2026
- Reserved
- Jun 30, 2026
Description
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Smart ManagerUnknown |
|
References
- https://wpscan.com/vulnerability/efcaa453-80f3-4565-a4f8-eefa231d77b6/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.