CVE-2026-14290: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-14290 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Embed Google Photos Album Easily" WordPress plugin affecting all versions through 2.2.1. The flaw allows authenticated users with the Contributor role or above to inject arbitrary JavaScript into posts, which then executes in the browser of any visitor — including administrators. It was publicly disclosed on August 11, 2026, and added to NVD on August 14, 2026. The vulnerability carries a CVSS score of 6.8 (Medium) (WPScan).

The root cause is improper output escaping (CWE-79: Improper Neutralization of Input During Web Page Generation) — specifically, the plugin fails to escape a shortcode attribute value before rendering it inside an HTML attribute in the page output. An attacker with at least Contributor-level access crafts a post containing a malicious [embed-google-photos-album] shortcode with a link attribute value containing a JavaScript payload (e.g., link="javascript:alert(1)" or an event handler injection). When any user views the post, the unescaped attribute is rendered in the browser DOM and the injected script executes. A proof-of-concept is scheduled for public release on August 25, 2026, per WPScan's coordinated disclosure policy (WPScan, GitHub Advisory).

Successful exploitation enables session hijacking, credential theft, and malware delivery against any user — including site administrators — who views an affected post. Because the payload executes in an administrator's browser, an attacker could leverage it to perform privileged actions such as creating rogue admin accounts, installing malicious plugins, or fully compromising the WordPress site. The stored nature of the XSS means a single malicious post can affect all future visitors without further attacker interaction (WPScan, GitHub Advisory).

No public proof-of-concept exploit is currently available; WPScan has indicated the PoC will be released on August 25, 2026. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is reported as 0.0, reflecting low current exploitation probability. Exploitation requires at minimum a Contributor-level WordPress account, limiting the attack surface compared to unauthenticated vulnerabilities (WPScan, GitHub Advisory).

1. Gain Contributor access: Register or compromise a WordPress account with at least the Contributor role on the target site running the Embed Google Photos Album Easily plugin ≤ 2.2.1.
2. Create or edit a post: Navigate to the WordPress post editor and insert the plugin's shortcode with a malicious link attribute, e.g., [embed-google-photos-album link="\" onmouseover=\"alert(document.cookie)"] or a similar HTML attribute injection payload.
3. Publish the post: Submit the post for publication (or save as pending review). The unescaped attribute value is stored in the database and rendered in the page HTML without sanitization.
4. Trigger victim execution: When any user (including an administrator) views the post in their browser, the injected JavaScript executes automatically or upon interaction, depending on the event handler used.
5. Harvest session or escalate privileges: Use the executed script to exfiltrate session cookies to an attacker-controlled server, perform authenticated actions on behalf of the victim (e.g., create a new admin account via AJAX), or redirect the victim to a phishing/malware page (WPScan).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from Contributor-level accounts containing shortcode content with unusual attribute values (e.g., onmouseover, onerror, javascript:, <script> patterns).
• Database: Suspicious entries in the wp_posts table where the post_content field contains the plugin's shortcode with JavaScript event handlers or encoded script payloads in the link attribute.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after loading posts containing the plugin's shortcode (indicative of cookie/session exfiltration).
• Browser/Application: Unexpected JavaScript alerts, redirects, or new administrator accounts created without authorization following administrator visits to affected posts (WPScan).

The Feedly advisory indicates a patch is available as of August 14, 2026 — users should update the Embed Google Photos Album Easily plugin to version 2.2.2 or later. Note that WPScan's listing states "No known fix" for the plugin slug embed-google-photos-album-easily as of the disclosure date, so administrators should verify patch availability in the WordPress plugin repository before updating. As interim mitigations: restrict the Contributor role to trusted users only, implement a Content Security Policy (CSP) header to limit JavaScript execution, and consider disabling the plugin until a confirmed patched version is available (WPScan, GitHub Advisory).

The vulnerability was discovered and submitted by security researcher "testoun" via WPScan's coordinated disclosure program. No significant broader media coverage or notable public researcher commentary beyond the standard vulnerability disclosure has been identified at this time (WPScan).