Cross-Site Scripting Vulnerability in Smart Manager Plugin by WordPress
CVE-2026-14203

Currently unrated

Key Information:

Vendor

WordPress
Status
Smart Manager
Vendor
CVE Published:
27 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-14203?

The Smart Manager plugin for WordPress versions prior to 8.92.0 contains a cross-site scripting vulnerability due to improper encoding of a post field before rendering it into an HTML attribute. This flaw allows users with the Contributor role or higher to inject malicious JavaScript code. When an administrator views the management grid, this injected script executes in their browser session, potentially compromising sensitive operations and data. It is crucial for users to upgrade to the latest version to mitigate this security risk.

Affected Version(s)

Smart Manager 0 < 8.92.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-14203 - Proof of Concept

References

https://wpscan.com/vulnerability/efcaa453-80f3-4565-a4f8-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

TruongLV1 From FPT Nightwolf
WPScan
.