CVE-2026-14287
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors.
Risk Assessment
An attacker can inject malicious script into the page, potentially leading to visitor data theft, phishing, or malware distribution.
Recommendation
Update the plugin to version 2.33.5 or later, which includes fixes for token validation and content escaping.
Original NVD description (English source)
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.