CVE-2026-14287

MediumCVSS 4.7/10Last modified Oct 22, 2026

Description

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	10Web Booster	< 2.33.5

References

https://wpscan.com/vulnerability/a0519e86-b77e-4354-a91d-ff729514d570/

Timeline

Published: Aug 19, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-142883.1GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that CVE-2026-142899.0The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only pro CVE-2026-14295.4Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attac CVE-2026-142906.8The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML CVE-2026-142917.5The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentic CVE-2026-142925.4The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package CVE-2026-142938.8The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public reques CVE-2026-142967.5When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active sl CVE-2026-142978.7A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler a CVE-2026-142986.5Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and en CVE-2026-14304.8The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2026-143008.1The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code