# CVE-2026-14565: Advanced Customized Prompts WordPress plugin stored XSS via product popup configuration

Source: https://junglewise.ai/threats/cve-2026-14565-advanced-customized-prompts-wordpress-plugin-stored-xss-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-14565 · Severity: medium · CVSS 5.4 · Published 2026-09-11

The Advanced Customized Prompts WordPress plugin allows low-privileged users (including subscribers) to inject malicious JavaScript into popup configurations without any permission or validation checks. When visitors view an affected product, the injected script executes in their browsers, potentially stealing credentials, redirecting to malicious sites, or defacing content. Site administrators relying on role-based access controls are exposed to compromise by untrusted users.

## Quick answers

**Is CVE-2026-14565 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14565 being exploited in the wild.

**How severe is CVE-2026-14565?** Medium severity, with a CVSS score of 5.4, published 11 September 2026.

**Which products and versions are affected?** Advanced Customized Prompts Advanced Customized Prompts through 1.0.1.

**Is there a fix for CVE-2026-14565?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14565 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14565?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Advanced Customized Prompts plugin (CVE-2026-14565, CWE-79). The plugin fails to validate user capabilities, ownership, or nonce tokens before saving popup configuration data to product metadata, and does not escape output when rendering stored values. Any authenticated user—including subscribers with minimal privileges—can craft malicious JavaScript payloads and store them via the popup configuration endpoint. When product pages are viewed by other users or site visitors, the unescaped payload executes in their browser context. No patch is currently available as of the advisory date.

## Affected products

- Advanced Customized Prompts Advanced Customized Prompts through 1.0.1

## Timeline

- 2026-09-09: disclosed
- 2026-09-11: advisory

## References

- [https://wpscan.com/vulnerability/613e5421-9da5-408a-b35d-b0def567e8db/](https://wpscan.com/vulnerability/613e5421-9da5-408a-b35d-b0def567e8db/)