What is CVE-2026-14592?

CVE-2026-14592 is a medium-severity vulnerability in Wp Real Ip-Based Access Control, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-07-30.

How severe is CVE-2026-14592?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Wp Real Ip-Based Access Control

CVE-2026-14592

The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (11.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Unknown Wp Real Ip-based Access Control — versions 0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-14592?: CVE-2026-14592 is a medium-severity vulnerability in Wp Real Ip-Based Access Control, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-07-30.
How severe is CVE-2026-14592?: Medium severity. CVSS v3 base score is 6.1 out of 10.