CVE-2026-14290: CWE-79 Cross-Site Scripting (XSS) in Embed Google Photos album
The Embed Google Photos album WordPress plugin through version 2.2.1 contains a Cross-Site Scripting (XSS) vulnerability. This flaw arises because the plugin does not properly escape a shortcode attribute value before outputting it inside an HTML attribute. Users with the Contributor role or higher can exploit this to inject arbitrary JavaScript. The injected script executes in the browsers of any users viewing the affected post, including administrators. No patch or official remediation guidance is currently available. There is no known exploitation in the wild at this time.
AI Analysis
Technical Summary
CVE-2026-14290 is a Cross-Site Scripting (CWE-79) vulnerability in the Embed Google Photos album WordPress plugin versions up to 2.2.1. The vulnerability occurs because the plugin fails to escape shortcode attribute values before embedding them in HTML attributes. This allows users with Contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of any user viewing the affected post, potentially leading to session hijacking or other malicious actions. No CVSS score or patch information is currently provided.
Potential Impact
Users with Contributor role or above can inject arbitrary JavaScript into posts via shortcode attributes. This script executes in the browsers of any users viewing the post, including administrators, potentially compromising their accounts or site integrity. The vulnerability could lead to unauthorized actions performed with the privileges of the victim user. However, there are no reports of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor role permissions or avoid using the affected plugin version. Monitor official sources for updates and apply patches promptly once released.
CVE-2026-14290: CWE-79 Cross-Site Scripting (XSS) in Embed Google Photos album
Description
The Embed Google Photos album WordPress plugin through version 2.2.1 contains a Cross-Site Scripting (XSS) vulnerability. This flaw arises because the plugin does not properly escape a shortcode attribute value before outputting it inside an HTML attribute. Users with the Contributor role or higher can exploit this to inject arbitrary JavaScript. The injected script executes in the browsers of any users viewing the affected post, including administrators. No patch or official remediation guidance is currently available. There is no known exploitation in the wild at this time.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14290 is a Cross-Site Scripting (CWE-79) vulnerability in the Embed Google Photos album WordPress plugin versions up to 2.2.1. The vulnerability occurs because the plugin fails to escape shortcode attribute values before embedding them in HTML attributes. This allows users with Contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of any user viewing the affected post, potentially leading to session hijacking or other malicious actions. No CVSS score or patch information is currently provided.
Potential Impact
Users with Contributor role or above can inject arbitrary JavaScript into posts via shortcode attributes. This script executes in the browsers of any users viewing the post, including administrators, potentially compromising their accounts or site integrity. The vulnerability could lead to unauthorized actions performed with the privileges of the victim user. However, there are no reports of active exploitation in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor role permissions or avoid using the affected plugin version. Monitor official sources for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-01T08:41:18.381Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7eb1a0bf8831d5398754aa
Added to database: 08/14/2026, 06:11:44 UTC
Last enriched: 08/14/2026, 06:30:47 UTC
Last updated: 08/14/2026, 06:34:48 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.