Smart Manager < 8.92.0 – Contributor+ Stored XSS via Post Title | CVE 2026-14203

Description

The plugin does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

Proof of Concept

Prerequisites: Smart Manager active (the Posts module does not require WooCommerce); a Contributor account.

1. As a Contributor, create a draft post with this exact title:
       " onmouseover="alert(origin)" x="
   (The title contains no <, > or &, so it is stored verbatim and survives KSES.)

2. As an Administrator, open Smart Manager:
       /wp-admin/admin.php?page=smart-manager
   and switch the module selector to "Posts".

3. Hover the mouse over the post-title cell in the grid.

Expected result: alert(origin) executes in the administrator's browser session, proving attacker-controlled JavaScript runs in the admin context. The grid endpoint returns the title raw (only JSON-escaped); the client renderer concatenates it into a title="..." attribute via innerHTML, and the double quote breaks out of the attribute.