CVE-2026-14203 is a CWE-79 Cross-Site Scripting vulnerability in the Smart Manager WordPress plugin. The issue arises because the plugin fails to properly encode a post field before inserting it into an HTML attribute within its management grid interface. This flaw enables users with Contributor role or above to inject malicious JavaScript code. When an administrator views the affected management grid, the injected script executes in their browser session, potentially leading to session hijacking or other client-side impacts. The vulnerability affects versions prior to 8.92.0, though no explicit affected versions or patch information is provided in the data.

The vulnerability allows users with Contributor role or higher to inject JavaScript that executes in the browser session of an administrator viewing the management grid. This can lead to client-side code execution impacting confidentiality and integrity of the administrator's session. The CVSS score of 4.8 reflects a medium severity with low confidentiality and integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 8.92.0, upgrading to version 8.92.0 or later is likely to address the issue if such a version exists. Until an official fix is confirmed, restrict Contributor role users from accessing the management grid or limit administrative users from viewing untrusted content in the grid.