CVE-2026-14290: 
WordPress vulnerability analysis and mitigation

CVE-2026-14290 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Embed Google Photos Album Easily" WordPress plugin affecting all versions through 2.2.1. The flaw allows authenticated users with the Contributor role or above to inject arbitrary JavaScript into posts, which then executes in the browser of any visitor — including administrators. It was publicly disclosed on August 11, 2026, with the CVE record published on August 14, 2026. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium) (WPScan, Github Advisory).

The root cause is improper output encoding (CWE-79): the plugin fails to escape a shortcode attribute value before rendering it inside an HTML attribute, allowing raw JavaScript to be injected into the page DOM. An attacker with at least Contributor-level access crafts a malicious link shortcode attribute containing a JavaScript payload (e.g., link="javascript:alert(1)" or an event handler injection), which is stored in the post content and executed whenever any user views the post. Exploitation requires network access, low attack complexity, and authenticated access at the Contributor level or above, with user interaction (a victim viewing the post) required to trigger execution (WPScan, Github Advisory). A proof-of-concept is scheduled for public release on August 25, 2026, per WPScan's coordinated disclosure policy (WPScan).

Successful exploitation enables an attacker to execute arbitrary JavaScript in the browser context of any user — including site administrators — who views the compromised post. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating backdoor accounts or installing malicious plugins), and malware distribution to site visitors. The scope is limited to the affected WordPress site, but administrator-level compromise could result in full site takeover (WPScan, Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation; CISA's SSVC assessment confirms exploitation status as "none" and the attack is not automatable (WPScan). WPScan has indicated a PoC will be published on August 25, 2026, following a disclosure window. The EPSS score is approximately 0.16–0.29%, placing it in the lower percentiles for near-term exploitation likelihood (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the "Embed Google Photos Album Easily" plugin at version 2.2.1 or earlier. This can be done by checking the plugin's readme.txt file (e.g., /wp-content/plugins/embed-google-photos-album-easily/readme.txt) or using tools like WPScan.
2. Obtain Contributor access: Register or compromise an account with at least the Contributor role on the target WordPress site.
3. Create or edit a post: Navigate to the WordPress post editor and insert the plugin's shortcode with a malicious link attribute, for example: [embed_google_photos_album link="\" onmouseover=\"alert(document.cookie)\""] or a similar HTML attribute injection payload.
4. Publish the post: Submit the post for review or publish it directly (depending on role permissions), storing the malicious payload in the database.
5. Trigger execution: When any user (including an administrator) views the post, the unescaped attribute value is rendered in the HTML, causing the injected JavaScript to execute in their browser — enabling session cookie theft, credential harvesting, or further malicious actions (WPScan).

• Logs: WordPress access logs showing POST requests to /wp-admin/post.php or the REST API from Contributor-level accounts containing shortcode content with unusual attribute values (e.g., event handlers like onerror, onmouseover, or javascript: URIs).
• Database: Unexpected JavaScript payloads stored in the wp_posts table within shortcode attributes for the embed_google_photos_album shortcode.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages containing the plugin's shortcode.
• File System: Unexpected new administrator accounts or plugin/theme modifications following administrator exposure to the malicious post, indicating post-exploitation activity.

Update the "Embed Google Photos Album Easily" WordPress plugin to version 2.2.2 or later, which addresses the unescaped shortcode attribute output. As an interim measure, restrict the Contributor role from creating or editing posts that use this plugin's shortcode, or temporarily deactivate the plugin until patching is feasible. Additionally, implementing a Content Security Policy (CSP) header that restricts inline JavaScript execution can reduce the impact of XSS vulnerabilities site-wide (WPScan, Github Advisory).

The vulnerability was discovered and submitted by security researcher "testoun" via WPScan's responsible disclosure program, and was verified by WPScan prior to publication (WPScan). No significant broader media coverage or notable community commentary has been identified at this time, consistent with the moderate severity rating and lack of active exploitation.