CVE Explorer
CVE-2026-14203
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1
Preserved source conflicts
No provider value was silently selected as the winner.
cwe · 2 assertions
{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:046d5fd2709de609a12c50a76828962d8830cca1b8175b3473b30f7774f37ed9 · sha256:22b8264ee940b98b… · /containers/adp/0/problemTypes/0/descriptions/0
{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:046d5fd2709de609a12c50a76828962d8830cca1b8175b3473b30f7774f37ed9 · sha256:22b8264ee940b98b… · /containers/cna/problemTypes/0/descriptions/0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Smart Manager","vendor":"Unknown","versions":[{"lessThan":"8.92.0","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:046d5fd2709de609a12c50a76828962d8830cca1b8175b3473b30f7774f37ed9 · sha256:22b8264ee940b98b… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:046d5fd2709de609a12c50a76828962d8830cca1b8175b3473b30f7774f37ed9 · sha256:22b8264ee940b98b… · /containers/adp/0/metrics/0/cvssV3_1
CWE assertions
2 source assertions{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:046d5fd2709de609a12c50a76828962d8830cca1b8175b3473b30f7774f37ed9 · sha256:22b8264ee940b98b… · /containers/adp/0/problemTypes/0/descriptions/0
{"description":"CWE-79 Cross-Site Scripting (XSS)","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:046d5fd2709de609a12c50a76828962d8830cca1b8175b3473b30f7774f37ed9 · sha256:22b8264ee940b98b… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/efcaa453-80f3-4565-a4f8-eefa231d77b6/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:046d5fd2709de609a12c50a76828962d8830cca1b8175b3473b30f7774f37ed9 · sha256:22b8264ee940b98b… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.