CVE-2026-14234

Name of the Vulnerable Software and Affected Versions WOLF WordPress plugin versions prior to 1.1.0

Description The plugin fails to perform a nonce (a unique token used to prevent replay attacks) or capability check on an AJAX action. This allows an unauthenticated attacker to execute a cross-site request that tricks a logged-in administrator into writing arbitrary content, such as malicious scripts, into a post, leading to stored Cross-Site Scripting (XSS).

Recommendations Update the WOLF WordPress plugin to version 1.1.0 or later.