← Back to the live CVE advisory feed

CVE-2026-14835: SOGO Add Script to Individual Pages Header Footer

Severity

0 (N/A)

Affected versions

0 through 3.9

Patch status

Unknown

Published

2026-08-30T07:17:20.777

Modified

2026-08-30T07:17:20.777

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.

Technical summary

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.

View the official NVD record for CVE-2026-14835

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.