Advanced Customized Prompts CVE-2026-14565

Requires a valid WordPress account at subscriber level or above - exploitation is not possible against unauthenticated visitors. The advanced-customized-prompts plugin must be installed and active on the target WordPress site at version 1.0.1 or earlier. A victim user must subsequently visit the product page where the malicious popup configuration was saved (UI:R). Sites with open user registration or multi-author/multi-contributor setups face the highest exposure. No special server-side configuration, non-default feature toggle, or specific hosting environment is required beyond the plugin's presence.

The CVSS 5.4 score (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) accurately captures the moderate severity: exploitation requires a valid subscriber account (PR:L) and a victim must load the poisoned product page (UI:R), limiting mass opportunistic abuse. However, the S:C scope change elevates the real-world impact - a single subscriber can persistently compromise every future visitor to an affected product page, enabling session hijacking, credential harvesting via phishing overlays, or drive-by malware delivery. No CISA KEV listing and a low EPSS footprint suggest no confirmed widespread exploitation, but the public WPScan POC lowers the barrier to abuse significantly. The primary limiting factor is obtaining even minimal WordPress authentication; sites with open registration or weak subscriber-invite controls are disproportionately exposed. The nonce absence also means the injection action itself is CSRF-exploitable, meaning a logged-in subscriber who clicks a crafted link could be tricked into planting the payload - though this secondary vector is not explicitly stated in the advisory.

An attacker registers a free subscriber account on a WordPress site running the plugin, then submits a crafted popup configuration payload containing a malicious JavaScript snippet (e.g., a cookie-stealer or phishing overlay) targeting a popular product page - no admin interaction required. Because no nonce or capability check is enforced, the payload is persisted to the database and served unsanitized to every subsequent visitor who views that product. A public proof-of-concept at WPScan demonstrates this flow, making it accessible to low-skill attackers.