CVE-2026-14234— WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14234
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-14234
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14234
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14234 (1)
- 🔗 WOLF – WordPress Posts Bulk Editor and Manager < 1.1.0 – Stored XSS via CSRF | CVE 2026-14234 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-07-29 · 9 CVEs total
| CVE-2026-14224 | Easy Appointments <= 3.12.26 - Subscriber+ Cross-User Appointment Data Modification via ID | |
| CVE-2026-14300 | miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover | |
| CVE-2026-13690 | UsersWP < 1.2.67 - Two-Factor Authentication Bypass | |
| CVE-2026-13692 | PayU CommercePro <= 3.8.9 - Unauthenticated Order Tampering | |
| CVE-2026-11351 | ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosur | |
| CVE-2026-11974 | Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Download | |
| CVE-2026-13605 | Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute | |
| CVE-2026-13423 | Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call |
IV. Related Vulnerabilities
Same product: WOLF
Same vendor: Unknown
- CVE-2026-14224
Easy Appointments <= 3.12.26 - Subscriber+ Cross-User Appoin - CVE-2026-14300
miniOrange Social Login and Register < 7.8.0 - Unauthenticat - CVE-2026-13690
UsersWP < 1.2.67 - Two-Factor Authentication Bypass - CVE-2026-13692
PayU CommercePro <= 3.8.9 - Unauthenticated Order Tampering - CVE-2026-11351
ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published
V. Comments for CVE-2026-14234
No comments yet