CVE-2026-14835: SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user with contributor-level access or higher can exploit it. The plugin does not require the user to have the unfiltered_html capability before saving custom header or footer script values.
When does the injected JavaScript execute?
It executes when an administrator reviews the affected post. If the post is published, it also executes in the browsers of visitors viewing that post.
Are unpublished posts a risk?
Yes. Even before publication, an administrator who reviews a post containing a malicious script can trigger the stored XSS payload.
How can I identify potentially affected content?
Review posts for custom header or footer script values entered through this plugin's post metabox, particularly on posts created or edited by contributor-level users or other non-administrative accounts.