CVE-2026-14565: Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user, including a user with only Subscriber-level access, can save malicious popup configuration to a product because the affected functionality does not enforce capability, ownership, or nonce checks.
Who is exposed to the stored script?
Visitors who view a product containing the malicious popup configuration can have the attacker-controlled JavaScript execute in their browser.
How can I determine whether my site may be affected?
Sites using the advanced-customized-prompts WordPress plugin through version 1.0.1 may be affected. Review product popup configuration for unexpected or untrusted script-like content, especially changes made by low-privileged accounts.