CVE-2026-14835
SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.
| Vendor | unknown |
| Product | sogo add script to individual pages header footer |
| Published | Aug 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown sogo add script to individual pages header footer
Be the first to know when new unknown vulnerabilities affecting unknown sogo add script to individual pages header footer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / SOGO Add Script to Individual Pages Header Footer
0 ≤ 3.9
References
Credits
Chamseddine Bouzaiene WPScan