Stored Cross-Site Scripting in WOLF WordPress Plugin
CVE-2026-14234
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14234?
The WOLF WordPress plugin, prior to version 1.1.0, is vulnerable to a Stored Cross-Site Scripting (XSS) attack due to the absence of nonce or capability checks in an AJAX action. This flaw allows unauthenticated attackers to exploit the vulnerability by tricking a logged-in administrator into executing a malicious request. Consequently, attackers can inject arbitrary content, potentially including harmful scripts, into a post, jeopardizing the security of the website and its users.
Affected Version(s)
WOLF 0 < 1.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.