Script Injection Vulnerability in SOGO Add Script Plugin for WordPress
CVE-2026-14835

Currently unrated

Key Information:

Vendor

WordPress
Status
Sogo Add Script To Individual Pages Header Footer
Vendor
CVE Published:
30 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-14835?

The SOGO Add Script to Individual Pages Header Footer plugin for WordPress allows users with contributor-level access and above to insert unverified JavaScript code into the post metadata. This occurs because the plugin does not adequately sanitize or escape custom header/footer script values. As a result, malicious scripts can run in the browsers of administrators who review the affected posts and on visitors once the posts are published, potentially leading to unauthorized access or data theft.

Affected Version(s)

SOGO Add Script to Individual Pages Header Footer 0 <= 3.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-14835 - Proof of Concept

References

https://wpscan.com/vulnerability/f0b869b1-ef43-4540-9ca5-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chamseddine Bouzaiene
WPScan
.