CVE-2026-14290

MediumCVSS 6.8

Published: 14/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The Embed Google Photos album WordPress plugin through version 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

Risk Assessment

An attacker with Contributor role can execute scripts in the administrator's browser, which can lead to session theft, account takeover, or unauthorized actions. This can compromise data integrity and confidentiality.

Recommendation

Update the Embed Google Photos album plugin to the latest version that includes security fixes. Limit the number of users with Contributor role and above.

Original NVD description (English source)

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.