CVE-2026-14203

UNKNOWN 0.0

Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

Vendor	unknown
Product	smart manager
Published	Jul 27, 2026

Stay Ahead of the Next One

Get instant alerts for unknown smart manager

Be the first to know when new unknown vulnerabilities affecting unknown smart manager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Smart Manager

0 < 8.92.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/efcaa453-80f3-4565-a4f8-eefa231d77b6/

Credits

TruongLV1 From FPT Nightwolf WPScan