CVE-2026-14592 is a stored cross-site scripting vulnerability in the WP Real IP-based Access Control WordPress plugin through version 1.3.1. The plugin lacks proper authorization checks (capability or nonce verification) before saving option values and does not sanitize or escape these values on output. This allows unauthenticated attackers to inject malicious JavaScript code that executes when an administrator accesses the plugin's settings page, potentially compromising the administrator's session or site control.

An unauthenticated attacker can inject arbitrary JavaScript code that executes in the context of an administrator's browser when they visit the plugin's settings page. This could lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges. The vulnerability affects site confidentiality and integrity by enabling remote code execution in the administrator's context via the web interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's settings page to trusted administrators only and monitor for suspicious activity. Avoid visiting the plugin settings page from untrusted networks or devices. Follow vendor updates closely for an official patch or temporary workaround.