Vulnerability · Published Sep 11, 2026 · Assigned by WPScan

CVE-2026-14565Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

Medium 5.4

In plain English

A medium-severity cross-site scripting in advanced-customized-prompts from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 86.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.

Affected products (as reported)

Vendor	Product	Versions
Unknown	advanced-customized-prompts	0 – through 1.0.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/613e5421-9da5-408a-b35d-b0def567e8db/ exploit, vdb-entry, technical-description