CVE-2026-14565 advanced-customized-prompts CVE debrief

Who should care

Defenders responsible for WordPress installations, especially those with subscriber-level user accounts, should assess exposure and prioritize remediation to prevent potential attacks. This includes verifying the plugin version and restricting access to the WordPress installation to prevent unauthorized users from storing malicious content.

Why it matters

A vulnerability in the advanced-customized-prompts WordPress plugin allows authenticated users to store malicious JavaScript, potentially leading to unauthorized code execution in the context of the visitor's browser.

• An attacker could exploit this vulnerability to store malicious JavaScript that executes in the browser of visitors viewing the affected product.
• This could lead to unauthorized code execution in the context of the visitor's browser.
• Defenders should verify and remediate this vulnerability to prevent potential attacks.
• The vulnerability requires verification of the plugin version and remediation to prevent exploitation.

Technical summary

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product. This vulnerability requires verification of the plugin version and remediation to prevent exploitation in WordPress installations, especially those with subscriber-level user accounts.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those with subscriber-level user accounts.

Recommended defensive actions

• Verify the version of the advanced-customized-prompts WordPress plugin and update to a patched version if available.
• Restrict access to the WordPress installation to prevent unauthorized users from storing malicious content.
• Monitor the WordPress installation for suspicious activity, such as unexpected changes to popup configurations.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output. Defenders should verify the plugin version and assess exposure to prioritize remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.