CVE-2026-14835

Name of the Vulnerable Software and Affected Versions SOGO Add Script to Individual Pages Header Footer versions prior to 4.0

Description The plugin fails to sanitize or escape custom header and footer script values saved via the post metabox. Additionally, it does not restrict these actions to users with the unfiltered html capability. This allows users with contributor-level access or higher to perform a Stored Cross-Site Scripting (XSS) attack—a technique where malicious scripts are permanently stored on the target server—which then executes in the browser of administrators reviewing the post or any visitor once the post is published.

Recommendations Update SOGO Add Script to Individual Pages Header Footer to version 4.0 or later.