CVE-2026-14845

MediumCVSS 6.1/10Last modified Aug 26, 2026

Description

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-148464.5In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation CVE-2026-148474.3The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related A CVE-2026-148485.4The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-sub CVE-2026-148493.7The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predict CVE-2026-14852.8A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is sto CVE-2026-148508.8The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An a CVE-2026-148519.2A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally ide CVE-2026-148525.2Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local CVE-2026-148534.3The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check c CVE-2026-148547.5The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of it CVE-2026-148556.4The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and CVE-2026-148566.3A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by in