WordPress Advanced Customized Prompts plugin <= 1.0.1 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

CVE-2026-14563

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

CVE-2026-14565

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-14566

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

EUVD-2026-75962

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-14565

The advanced-customized-prompts WordPress plugin (through version 1.0.1 ) contains a Stored XSS vulnerability in its product popup configuration feature. The plugin fails to perform any capability, ownership, or nonce check before saving popup settings to a product and does not escape stored valu...

CVE-2026-14565 Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-14566 Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

EUVD-2026-75963

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering vulnerability

Subscriber+ WooCommerce Order Item Metadata Tampering vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

CVE-2026-14565 Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-14566

The advanced-customized-prompts WordPress plugin (versions ≤ 1.0.1 ) contains a missing authorization flaw: it performs no capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order ID. This allows any authenticated user with the Subscriber role or ...

CVE-2026-14563 Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

EUVD-2026-75961

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...

CVE-2026-14563

CVE-2026-14563 affects the advanced-customized-prompts WordPress plugin through version 1.0.1 . The root cause is a missing password verification before issuing an authenticated session for a supplied email address within an unauthenticated action. This allows unauthenticated attackers to either ...

PT-2026-89776

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

PT-2026-89775

The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action, allowing unauthenticated attackers to log in as any registered user, including administrators, or to creat...