Advanced Customized Prompts <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover
critical
The Advanced Customized Prompts plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.1. This is due to the plugin not verifying a user's password before authenticating them. This makes it possible for unauthenticated attackers to log in as other users, including adminsitr...
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 1.0.1
- Fix:
- No patched version reported
- Disclosed:
- Sep 9, 2026
CVE-2026-14563 on NVD →
Advanced Customized Prompts <= 1.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
medium
The Advanced Customized Prompts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitra...
- CVSS:
- 6.4
(Wordfence)
- Affected:
- up to 1.0.1
- Fix:
- No patched version reported
- Disclosed:
- Sep 9, 2026
CVE-2026-14565 on NVD →
Advanced Customized Prompts <= 1.0.1 - Missing Authorization
medium
The Advanced Customized Prompts plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
- CVSS:
- 4.3
(Wordfence)
- Affected:
- up to 1.0.1
- Fix:
- No patched version reported
- Disclosed:
- Sep 9, 2026
CVE-2026-14566 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database