CVE-2026-14203
Deferred Deferred - Pending Action

Stored XSS in Smart Manager WordPress Plugin

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: WPScan

Description
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-08-16
AI Q&A
2026-07-27
EPSS Evaluated
2026-08-15
NVD
CVE-2026-14203
EUVD
EUVD-2026-49078

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpbeaver smart_manager to 8.92.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Smart Manager WordPress plugin before version 8.92.0. Users with the Contributor role or higher can inject malicious JavaScript via the post title field. The injected script executes when an administrator views the Smart Manager grid, specifically in the Posts module.

Detection Guidance

Check if your WordPress site uses the Smart Manager plugin version prior to 8.92.0. Log in as a user with Contributor role or higher and inspect the Posts module in the Smart Manager grid for unusual post titles containing JavaScript event handlers like onmouseover. Administrators should review the grid for unexpected behavior when hovering over post titles.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of the admin, or redirect the admin to malicious sites. This could lead to unauthorized access to the WordPress site, data theft, or further compromise of the site's integrity.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations could face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Update the Smart Manager plugin to version 8.92.0 or later immediately. If updating is not possible, disable the plugin temporarily until an update is applied. Review user roles and restrict Contributor-level access to only trusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart