What is GHSA-48wv-hw8m-mfc2?

GHSA-48wv-hw8m-mfc2 is a security advisory published by GitHub Security Advisories with unknown severity. The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before...

Which CVE IDs does GHSA-48wv-hw8m-mfc2 cover?

GHSA-48wv-hw8m-mfc2 covers the following CVE IDs: CVE-2026-14203. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-48wv-hw8m-mfc2unknown

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before...

Vendor

GitHub Security Advisories

Published

July 27, 2026

Last Modified

July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-14203 →

📋 Description

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14203
https://wpscan.com/vulnerability/efcaa453-80f3-4565-a4f8-eefa231d77b6
https://github.com/advisories/GHSA-48wv-hw8m-mfc2