CVE-2026-14203

MediumCVSS 4.8/10Last modified Jul 27, 2026

Description

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownSmart Manager< 8.92.0

References

Timeline

Published
Jul 27, 2026
Last modified
Jul 27, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-142046.5The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to tCVE-2026-142059.8The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes CVE-2026-142067.5The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft,CVE-2026-142076.1The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and renderCVE-2026-142087.3Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities -CVE-2026-142094.3A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. WhCVE-2026-14215.4A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. SCVE-2026-142104.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 tCVE-2026-142113.8The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is rCVE-2026-142124.7The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) ownsCVE-2026-142133.7The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) isCVE-2026-142142.7The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its cu
CVE-2026-14203: Medium severity, CVSS 4.8 | Vulnix