CVE-2026-14293

This CVE — a stored XSS in styling options that output on a checkout page — follows a fifteen-year pattern in WordPress plugins that documentation alone has failed to break. The vulnerability isn't complex: an attacker with admin access (or session hijacking) can save a JavaScript payload as a color or font preference, and it executes when any admin views the affected page. But the blast radius here extends far beyond what CVSS 8.8 captures. The critical exposure: this is a checkout-adjacent plugin. Admin sessions in WordPress e-commerce contexts carry plugin installation and code editor capabilities. Compromising an admin session via this stored XSS creates a direct pivot point to RCE-level compromise — no second vulnerability required. One stored XSS in 'just a styling option' becomes a complete chain: unauthenticated entry (or admin compromise), stored XSS firing on checkout, session hijacking, WordPress backend access with plugin/code capabilities. The three failures — missing capability check, missing nonce validation, missing output escaping — are not independent oversights. They represent a single failure mode amplified across authentication, authorization, and output safety simultaneously. The WordPress settings API doesn't scaffold these protections in by default. Developers building 'just a color preference' feature operate in a cognitive context where threat modeling feels unnecessary: 'only admins save styling.' That framing strips away the attack surface entirely. For defenders: audit your plugins for any endpoint that accepts user input through admin settings and outputs that data in non-admin contexts — especially styling, display options, or 'cosmetic' features that predate the plugin's movement into payment-sensitive territory. Deprecation is not eradication; forgotten code paths don't receive retroactive threat models. The fix pattern is well-established: add `current_user_can()` capability checks, implement nonce validation even on 'settings only' endpoints, and apply `esc_html()` or `esc_attr()` to every output — CSS values are still user-controlled data, not trusted content.

Reviewed through automated stages and approved by a human before publication.