CVE-2025-14114 Overview
CVE-2025-14114 is a Stored Cross-Site Scripting (XSS) vulnerability in the 1180px Shortcodes plugin for WordPress. The flaw affects all versions up to and including 1.1.1 and stems from insufficient input sanitization and output escaping on the class shortcode attribute. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any user viewing the affected page. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated contributors can persist malicious scripts in WordPress pages, leading to session theft, administrative account takeover, and content manipulation when administrators view injected content.
Affected Products
- 1180px Shortcodes plugin for WordPress (all versions through 1.1.1)
- WordPress sites permitting Contributor-level registration with this plugin enabled
- Multi-author WordPress environments using vulnerable plugin versions
Discovery Timeline
- 2026-01-07 - CVE CVE-2025-14114 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-14114
Vulnerability Analysis
The vulnerability resides in the shortcode handler within 1180px.php at line 115 of the plugin source. The handler accepts a user-supplied class attribute and outputs it directly into the rendered HTML without applying WordPress escaping functions such as esc_attr(). Because the attribute value is reflected into an HTML element context, attackers can break out of the attribute boundary and inject script payloads.
The vulnerability requires authentication at Contributor level or above, which limits opportunistic exploitation. However, WordPress sites that permit open user registration or operate with multiple content authors face higher exposure. Once a payload is stored, it executes in the context of every authenticated user who views the affected page, including site administrators.
Root Cause
The root cause is missing input sanitization and output escaping on a shortcode attribute. WordPress provides functions such as sanitize_html_class() for class names and esc_attr() for attribute output, but neither is applied to the class parameter before it is concatenated into the response HTML. This permits arbitrary characters, including quote marks and angle brackets, to terminate the attribute and introduce new HTML or script content.
Attack Vector
An authenticated attacker with Contributor permissions creates or edits a post containing the vulnerable shortcode. The attacker supplies a crafted class attribute value that closes the surrounding attribute and appends an event handler or <script> tag. When the post is previewed or published and subsequently viewed, the injected JavaScript executes in the victim's browser session. The scope change in the CVSS vector indicates that exploitation can affect resources beyond the vulnerable component, such as administrative session cookies.
The vulnerability mechanism is documented in the WordPress Plugin Code Analysis and the Wordfence Vulnerability Report. No verified proof-of-concept code is publicly available.
Detection Methods for CVE-2025-14114
Indicators of Compromise
- Posts or pages containing 1180px shortcodes with unusual characters in the class attribute, such as quotation marks, angle brackets, or on* event handler names
- Database entries in wp_posts referencing <script>, javascript:, or onerror= within shortcode parameters
- Unexpected outbound HTTP requests from administrator browser sessions to attacker-controlled domains shortly after viewing content
Detection Strategies
- Audit the wp_posts table for shortcode invocations of the 1180px plugin with suspicious class attribute payloads
- Review WordPress activity logs for content edits by Contributor-level accounts that introduce shortcodes referencing this plugin
- Inspect HTTP response bodies served by the site for unescaped HTML markup originating from shortcode output
Monitoring Recommendations
- Enable WordPress audit logging to capture post creation and modification events by low-privilege users
- Deploy a web application firewall to flag shortcode parameters containing HTML control characters
- Monitor administrator account behavior for signs of session token abuse following content review activity
How to Mitigate CVE-2025-14114
Immediate Actions Required
- Disable or uninstall the 1180px Shortcodes plugin until a patched release is available
- Audit all Contributor-level and Author-level accounts and remove unused or untrusted accounts
- Review existing posts and pages for shortcode invocations from the affected plugin and remove any suspicious class attribute content
- Rotate administrator session cookies and credentials if compromise is suspected
Patch Information
At the time of publication, no fixed version is listed in the NVD entry. Versions through 1.1.1 remain vulnerable. Administrators should monitor the Wordfence Vulnerability Report and the plugin repository for an updated release that applies esc_attr() or sanitize_html_class() to the class attribute.
Workarounds
- Restrict the User Registration setting in WordPress to prevent untrusted account creation
- Limit Contributor and Author role assignments to vetted users only
- Use a web application firewall rule to block shortcode parameters containing HTML control characters such as ", <, and >
- Apply a Content Security Policy that blocks inline scripts to limit the impact of injected payloads
# Disable the vulnerable plugin via WP-CLI until a patched release is published
wp plugin deactivate 1180px-shortcodes
wp plugin delete 1180px-shortcodes
# Restrict open registration
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
