CVE-2026-14290

MediumCVSS 6.8/10Last modified Aug 26, 2026

Description

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-142917.5The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authenticCVE-2026-142925.4The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end packageCVE-2026-142938.8The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public requesCVE-2026-142967.5When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slCVE-2026-142978.7A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler aCVE-2026-142986.5Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enCVE-2026-14304.8The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users suCVE-2026-143008.1The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code CVE-2026-143045.5In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based applicatCVE-2026-143055.3The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticateCVE-2026-143064.3The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowiCVE-2026-143077.1The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX respon
CVE-2026-14290: Medium severity, CVSS 6.8 | Vulnix