CVE-2026-14287 is a CWE-79 Cross-Site Scripting vulnerability in the 10Web Booster WordPress plugin prior to version 2.33.5. The flaw arises because the plugin does not correctly validate an access token on an unauthenticated request handler and fails to escape attacker-supplied stylesheet content before rendering it into the page head. This enables an unauthenticated attacker to store malicious markup that executes as JavaScript in the browsers of anonymous visitors to the affected pages.

An unauthenticated attacker can inject malicious JavaScript that executes in the context of anonymous visitors' browsers. This could lead to limited confidentiality and integrity impacts such as theft of information accessible to the browser or manipulation of page content. The CVSS score of 4.7 reflects a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, and a scope change.

A fix is available in 10Web Booster version 2.33.5. Users should upgrade to version 2.33.5 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.