CVE-2026-14565
MediumCVSS 5.4Summary
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output. This allows any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
Risk Assessment
An authenticated low-privilege user can inject malicious JavaScript that executes in the browsers of product visitors, potentially leading to session or data theft. The risk affects all customers viewing the infected product.
Recommendation
Update the advanced-customized-prompts plugin to a version later than 1.0.1 or remove it if unused. Review product popup configurations for injected code.
Other vulnerabilities in advanced-customized-prompts WordPress plugin
See all- CVE-2026-14566Medium
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order. This allows any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
- CVE-2026-14563Critical
The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts.
Original NVD description (English source)
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.