CVE-2026-14234

Deferred Deferred - Pending Action

Stored XSS in WOLF WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: WPScan

Description

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-18

AI Q&A

2026-07-29

EPSS Evaluated

2026-08-17

NVD

CVE-2026-14234

EUVD

EUVD-2026-50120

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the WOLF WordPress plugin before version 1.1.0. It occurs because the plugin fails to perform a nonce or capability check on an AJAX action. An unauthenticated attacker can exploit this by tricking a logged-in administrator into visiting a malicious page, which then sends a crafted request to the vulnerable endpoint. This request writes arbitrary content, including malicious scripts, into a post. The script executes when the post is viewed.

Detection Guidance

Check if the WOLF WordPress plugin version is below 1.1.0. Inspect network traffic for suspicious AJAX requests to the vulnerable endpoint. Look for unauthorized post content modifications or unexpected script injections in WordPress posts.

Impact Analysis

If you are a WordPress administrator using the WOLF plugin before version 1.1.0, an attacker could inject malicious scripts into your posts. These scripts could steal sensitive data, hijack user sessions, or deface your website. Visitors to your site may also be affected if they view the compromised posts.

Compliance Impact

This vulnerability could lead to data breaches, compromising personal or sensitive data stored on your WordPress site. This may violate GDPR if personal data is exposed or HIPAA if protected health information is affected. Non-compliance with these regulations can result in legal penalties and reputational damage.

Mitigation Strategies

Update the WOLF plugin to version 1.1.0 or later. Remove any unauthorized or suspicious content from posts. Implement additional security measures like disabling AJAX actions for non-administrators if possible.

Hi! I’m here to help you understand CVE-2026-14234. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70