CVE-2026-14565 advanced-customized-prompts CVE debrief

Who should care

Defenders responsible for WordPress installations, particularly those with the advanced-customized-prompts plugin, should assess exposure and prioritize verification of the plugin's presence and remediation. This includes reviewing the plugin's configuration, verifying the version, and ensuring that it is updated to a version that fixes the vulnerability. Additionally, defenders should review compensating controls and monitor for potential exploitation.

Why it matters

The CVE-2026-14565 vulnerability in the advanced-customized-prompts WordPress plugin allows authenticated users to store malicious JavaScript code that executes in the browser of visitors viewing the affected product. Defenders responsible for WordPress installations should assess exposure and prioritize verification of the plugin's presence and remediation.

• An attacker could inject malicious JavaScript code that executes in the browser of visitors viewing the affected product.
• An attacker could potentially steal user data or take control of the user's session.
• Defenders need to verify the presence of this plugin in their WordPress installations and ensure that it is updated to a version that fixes the vulnerability.

Technical summary

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output. This allows any authenticated user, such as a subscriber, to store JavaScript that executes in the browser of visitors viewing the affected product. The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM. Defenders should prioritize verifying the presence of this plugin in their WordPress installations and ensure that it is updated to a version that fixes the vulnerability.

Defensive priority

Defenders should prioritize verifying the presence of this plugin in their WordPress installations and ensure that it is updated to a version that fixes the vulnerability.

Recommended defensive actions

• Verify the presence of the advanced-customized-prompts WordPress plugin in your WordPress installations.
• Check if the plugin is updated to a version that fixes the vulnerability.
• Restrict access to the WordPress installation to prevent unauthorized users from storing malicious JavaScript code.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability. However, the scope of affected versions and remediation steps require verification from the official sources. Defenders should verify the presence of this plugin in their WordPress installations and ensure that it is updated to a version that fixes the vulnerability. The official CVE Program record and NVD detail page provide source-provided CVE metadata and vulnerability assessment. Additional verification is necessary to confirm affected

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.