CVE-2026-14290

CVE-2026-14290CVE-2026-14290

Description

The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

Scoring

CVSS 6.8 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Last modified2026-08-14
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.