CVE-2026-14835: Unknown Sogo Add Script To Individual Pages Header Footer

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.

Affected products

• Unknown Sogo Add Script To Individual Pages Header Footer: up to and including 3.9

Published 2026-08-30. Last modified 2026-08-31.