CVE-2026-14234: Unknown Wolf

High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days.

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.

Affected products

• Unknown Wolf: before 1.1.0 (fixed in 1.1.0)

Published 2026-07-29. Last modified 2026-07-30.