Vulnerabilities and security researches foroh-add-script-header-footer oh-add-script-header-footer

Sep 01, 2026

CVE, Research URL: CVE-2026-14835
Home page URL: Security reports for SOGO Add Script to Individual Pages Header Footer
Application: SOGO Add Script to Individual Pages Header Footer
Date: Aug 30, 2026
Research Description: The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.
Affected versions: max 3.9.
Status: vulnerable