Unrated severityNVD Advisory· Published Jul 30, 2026· Updated Jul 30, 2026
WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addr
CVE-2026-14592
Description
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.3.1
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/5f2fb7cd-5330-4721-ab1b-d8c247786c8f/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.