CVE-2026-14565 is a cross-site scripting (XSS) vulnerability in the advanced-customized-prompts WordPress plugin through version 1.0.1. The plugin does not verify user capabilities, ownership, or nonce tokens before saving popup configuration data to a product. Additionally, it fails to escape stored values when rendering the product page. As a result, any authenticated user, such as a subscriber, can inject malicious JavaScript code that executes in the browsers of visitors viewing the affected product, potentially leading to session hijacking or other client-side attacks.

Any authenticated user, including low-privileged roles like subscribers, can inject arbitrary JavaScript into product pages. This script executes in the browsers of visitors, potentially enabling theft of session cookies, defacement, or other malicious client-side actions. The vulnerability undermines the trustworthiness of the affected product pages and can lead to broader site compromise if exploited.

No official patch or fix is currently documented. Users should monitor the vendor or plugin repository for updates addressing this vulnerability. Until a fix is available, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Implementing additional web application firewall (WAF) rules to detect and block suspicious input may provide temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.