CVE-2026-14592 is a CWE-79 Cross-Site Scripting vulnerability in the WP Real IP-based Access Control WordPress plugin through version 1.3.1. The plugin lacks proper capability and nonce verification before storing an option value and does not escape this value when rendering the settings page. This allows unauthenticated attackers to inject arbitrary JavaScript code that executes with administrator privileges when the settings page is accessed.

An unauthenticated attacker can inject and store malicious JavaScript code that executes in the browser context of any administrator who views the plugin's settings page. This can lead to session hijacking, privilege escalation, or other attacks limited to the administrator's browser context. The vulnerability does not affect availability and has limited confidentiality and integrity impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's settings page to trusted administrators only and consider disabling or removing the plugin if possible.