Quick answers
- Is CVE-2026-14203 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14203 being exploited in the wild.
- How severe is CVE-2026-14203?
- Informational severity, with a CVSS score of 6.8, published 27 July 2026.
- Which products and versions are affected?
- StoreApps Smart Manager for WooCommerce < 8.92.0.
- Is there a fix for CVE-2026-14203?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14203 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-14203?
- Check whether you run StoreApps Smart Manager for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Smart Manager plugin due to improper encoding of post fields (such as the post title) before rendering them into HTML attributes within the management grid. The client-side renderer concatenates these fields into attributes like 'title' using innerHTML without sufficient sanitization. An attacker with Contributor-level privileges can craft a post title containing double quotes to break out of the HTML attribute and inject event handlers (e.g., onmouseover). When an administrator views the 'Posts' module in the Smart Manager dashboard and interacts with the grid, the injected script executes in their session. This issue is fixed in version 8.92.0.
Affected products
- StoreApps Smart Manager for WooCommerce < 8.92.0
Timeline
- 2026-02-13: disclosed: Initial discovery/disclosure date mentioned in references
- 2026-07-06: advisory: WPScan advisory published
- 2026-07-27: advisory: NVD record published