CVE-2026-14203

MEDIUM

Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title

Title source: cna

Description

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/efcaa453-80f3-4565-a4f8-eefa231d77b6/

Scores

CVSS v3 4.8

EPSS 0.0014

EPSS Percentile 4.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

None/Smart Manager < 8.92.0

Published Jul 27, 2026

Tracked Since Jul 27, 2026