CVE-2026-14592
WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addr
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.
| Vendor | unknown |
| Product | wp real ip-based access control |
| Published | Jul 30, 2026 |
| Last Updated | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp real ip-based access control
Be the first to know when new medium vulnerabilities affecting unknown wp real ip-based access control are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Real IP-based Access Control
0 ≤ 1.3.1
References
Credits
Abaid Ur Rehman WPScan