CVE-2025-14110: WordPress WP Js List Pages XSS Flaw

CVE-2025-14110 Overview

CVE-2025-14110 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Js List Pages Shortcodes plugin for WordPress. The flaw affects all plugin versions up to and including 1.21. The plugin fails to sanitize input and escape output on the class shortcode attribute. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page. The vulnerability is tracked under CWE-79 and originates in the shortcode handling logic of js-list-pages-shortcodes.php.

Critical Impact
Authenticated low-privilege contributors can persist JavaScript that executes against site administrators and visitors, enabling session theft, account takeover, and arbitrary redirection.

Affected Products

WP Js List Pages Shortcodes plugin for WordPress — all versions through 1.21
WordPress sites permitting Contributor-level (or higher) account registration
Multi-author WordPress deployments using the plugin to render page lists via shortcode

Discovery Timeline

2026-01-07 - CVE-2025-14110 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14110

Vulnerability Analysis

The plugin registers a shortcode that accepts a class attribute used to apply CSS classes to the generated page list markup. The value supplied to class is concatenated directly into HTML output without sanitization or context-aware escaping. Any user permitted to author posts or pages, including Contributors, can embed the shortcode and supply an attribute payload containing HTML break-out sequences and inline event handlers. When the page is rendered, the browser parses the injected attribute as executable script. The stored nature of the flaw means each visit to the affected page re-triggers execution, broadening the attack surface to administrators reviewing pending content.

Root Cause

The defect is missing input sanitization and missing output escaping for shortcode attributes. WordPress provides helpers such as esc_attr() and sanitize_html_class() for exactly this scenario, but the shortcode handler in js-list-pages-shortcodes.php (referenced at lines 47, 50, and 58 of the trunk source) does not invoke them on the user-controlled class value. See the WordPress Plugin Code Reference for the vulnerable construct.

Attack Vector

The attacker authenticates with a Contributor-level (or higher) account, creates or edits a post or page, and inserts the plugin's shortcode with a crafted class attribute. The payload breaks out of the attribute context and introduces an inline event handler or <script> element. When an administrator previews the submission or a visitor loads the published page, the script runs in the victim's session. Typical post-exploitation actions include stealing authentication cookies, issuing privileged REST API calls, planting a backdoor administrator account, or pivoting to deliver client-side malware. Additional context is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-14110

Indicators of Compromise

Post or page content containing the plugin's shortcode with a class attribute that includes quote characters, angle brackets, on*= handlers, or the string javascript:.
Unexpected new WordPress administrator accounts or modified user roles created shortly after a Contributor submission was reviewed.
Browser console errors or outbound requests to unfamiliar domains originating from pages that render the plugin's shortcode.

Detection Strategies

Query the wp_posts table for post_content values matching the plugin's shortcode tag combined with suspicious attribute payloads.
Review WordPress audit logs for Contributor accounts editing or creating content that uses the affected shortcode.
Inspect rendered HTML of pages using the shortcode for inline event handlers or script tags emitted from the class attribute.

Monitoring Recommendations

Forward WordPress access and audit logs to a centralized analytics platform and alert on anomalous role changes, plugin file modifications, and administrator logins from new IP addresses.
Enable a web application firewall rule that inspects POST bodies to /wp-admin/post.php for shortcode attributes containing HTML metacharacters.
Monitor outbound HTTP requests from authenticated administrator browsers for connections to non-allowlisted destinations.

How to Mitigate CVE-2025-14110

Immediate Actions Required

Deactivate the WP Js List Pages Shortcodes plugin until a patched release is installed.
Audit all Contributor, Author, and Editor accounts and remove any that are not actively required.
Review existing posts and pages for unexpected use of the plugin's shortcode and remove malicious class attribute payloads.

Patch Information

At the time of NVD publication, all versions through 1.21 are affected. Track the plugin's WordPress.org listing and the Wordfence Vulnerability Report for the fixed release, then update to the patched version once available. A correct fix wraps the class attribute value in esc_attr() and ideally validates it through sanitize_html_class() before output.

Workarounds

Restrict shortcode usage by removing the plugin's shortcode registration via a small mu-plugin until an upstream fix ships.
Limit content creation privileges so untrusted users cannot publish or save shortcodes that render to public pages.
Deploy a Content Security Policy (CSP) that disallows inline scripts and unsafe event handlers to blunt the impact of any injected payload.

bash

# Configuration example: temporarily disable the vulnerable shortcode
# Place in wp-content/mu-plugins/disable-jslp-shortcode.php
<?php
add_action('init', function () {
    remove_shortcode('jslp');
    remove_shortcode('js-list-pages');
}, 99);