CVE-2026-14565

The advanced-customized-prompts WordPress plugin (versions through 1.0.1 ) is vulnerable to a Stored XSS flaw. The issue arises because the plugin fails to perform necessary capability, ownership, or nonce checks before saving popup configurations to a product, and it fails to escape stored value...

CVE-2026-14565 Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-14565 Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...