THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-14835 — The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contribu

[NVD] CVE-2026-14835 — The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contribu

mednvdPublished 2026-08-30

CVE-2026-14835 CVSS: None Published: 2026-08-30T07:17:20.777

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that execu

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-14835cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-14835