CVE-2026-14234
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions. This allows an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting (XSS).
Risk Assessment
An attacker can inject a malicious script that executes in visitors' browsers, potentially leading to session theft, redirects, or data theft.
Recommendation
Update the WOLF plugin to version 1.1.0 or later.
Other vulnerabilities in WordPress plugin
See all- CVE-2026-14300High
The miniOrange Social Login and Register WordPress plugin before 7.8.0 does not bind the one-time code used for optional email verification to the account it was issued for. This allows an unauthenticated attacker to obtain a valid session for any account, including administrators, by requesting a code for a controlled email and replaying it against the victim's email.
- CVE-2026-13690High
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler. This allows an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
- CVE-2026-13605Medium
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption written into the page DOM without escaping. An authenticated user with Author-level access can store a JavaScript payload that executes in any visitor's browser, including an administrator, who clicks the link.
- CVE-2026-11351Medium
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints. This allows unauthenticated users to retrieve information about non-published WooCommerce products (e.g., draft, pending, or private).
Original NVD description (English source)
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.