CVE-2026-14234
N/A
N/A
Summary
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WOLF | 0 < 1.1.0 | affected |
Weaknesses
- CWE-79 Cross-Site Scripting (XSS)
- CWE-352 Cross-Site Request Forgery (CSRF)
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.