CVE-2026-14835: CWE-79 Cross-Site Scripting (XSS) in SOGO Add Script to Individual Pages Header Footer

CVE-2026-14835 is a CWE-79 Cross-Site Scripting vulnerability in the SOGO Add Script to Individual Pages Header Footer WordPress plugin up to version 3.9. The plugin does not properly sanitize or escape custom scripts added to individual page headers or footers via the post metabox. Additionally, it does not restrict this functionality to users with the unfiltered_html capability, enabling users with contributor-level privileges or higher to store malicious JavaScript. This script executes in the browsers of administrators who review the post and any visitors once the post is published, potentially leading to credential theft, session hijacking, or other malicious actions.

Successful exploitation allows users with contributor-level access or higher to inject and store malicious JavaScript code that executes in the browsers of administrators and site visitors. This can lead to compromise of administrator accounts, site defacement, data theft, or other attacks leveraging the elevated privileges of administrators or the trust of site visitors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level user privileges to trusted users only and monitor for suspicious activity. Avoid reviewing posts from untrusted contributors without caution. Consider disabling or removing the vulnerable plugin if possible.