CVE-2025-14118: Starred Review Plugin XSS Vulnerability

CVE-2025-14118 Overview

The Starred Review plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability in the PHP_SELF variable handling. All versions up to and including 1.4.2 are affected due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user is tricked into performing an action such as clicking on a malicious link.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in the context of authenticated user sessions, potentially leading to session hijacking, credential theft, or unauthorized actions on WordPress sites using the vulnerable plugin.

Affected Products

• Starred Review WordPress Plugin versions up to and including 1.4.2
• WordPress sites with the Starred Review plugin installed and active

Discovery Timeline

• January 7, 2026 - CVE-2025-14118 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-14118

Vulnerability Analysis

This Reflected Cross-Site Scripting vulnerability exists in the Starred Review WordPress plugin due to improper handling of the PHP_SELF server variable. The plugin fails to properly sanitize user-controllable input before reflecting it back in HTML output, creating an opportunity for script injection. When a victim clicks a specially crafted link, the malicious payload executes within their browser session with full access to the WordPress site's DOM and any associated authentication tokens.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which is among the most prevalent web application security issues. The attack requires user interaction—specifically, the victim must click a malicious link—but requires no authentication or special privileges from the attacker's perspective.

Root Cause

The root cause stems from the direct use of the PHP_SELF superglobal variable without proper sanitization or escaping before output. The PHP_SELF variable contains the filename of the currently executing script relative to the document root, but it can be manipulated by attackers through URL path injection. When this unsanitized value is echoed back into HTML output (typically in form action attributes), attackers can inject arbitrary HTML and JavaScript code.

The vulnerable code can be found at line 29 in starred-review.php, where input escaping functions such as esc_url() or esc_attr() are not applied to the PHP_SELF value before rendering.

Attack Vector

The attack is network-based and requires tricking a victim into clicking a malicious URL. An attacker constructs a URL targeting the vulnerable WordPress page with a crafted path containing JavaScript payload. The attack flow typically involves:

1. Attacker identifies a WordPress site running the vulnerable Starred Review plugin
2. Attacker crafts a malicious URL containing XSS payload in the path
3. Attacker delivers the URL to victims via phishing, social engineering, or posting on forums
4. Victim clicks the link while authenticated to the WordPress site
5. Malicious script executes in victim's browser with their session context

The vulnerability mechanism involves manipulating the URL path to inject script tags or event handlers that bypass the lack of output encoding. For detailed technical analysis, refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-14118

Indicators of Compromise

• Suspicious access logs showing unusual URL paths containing encoded JavaScript payloads targeting Starred Review plugin pages
• Web application firewall (WAF) logs detecting XSS patterns in request URIs
• User reports of unexpected browser behavior or redirects when interacting with review functionality
• Unusual outbound connections from client browsers during plugin page interactions

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in URL paths
• Implement Content Security Policy (CSP) headers to restrict script execution sources and mitigate XSS impact
• Monitor WordPress access logs for requests containing suspicious characters like <, >, script, or URL-encoded variants in the path
• Use WordPress security plugins to scan for known vulnerable plugin versions

Monitoring Recommendations

• Enable detailed access logging on WordPress installations and configure alerts for XSS signature patterns
• Implement browser-side XSS auditor logging where supported to detect client-side exploitation attempts
• Review WordPress plugin inventory regularly to identify outdated or vulnerable plugins
• Set up automated vulnerability scanning to detect installations running affected Starred Review versions

How to Mitigate CVE-2025-14118

Immediate Actions Required

• Update the Starred Review plugin to the latest patched version immediately
• If an update is not available, deactivate and remove the Starred Review plugin until a fix is released
• Review WordPress access logs for signs of exploitation targeting this vulnerability
• Implement a Web Application Firewall with XSS protection rules as an additional defense layer

Patch Information

Plugin administrators should check for updates via the WordPress plugin repository. The vulnerability affects all versions through 1.4.2. Monitor the WordPress Plugin Repository for the latest patched release. Additionally, consult the Wordfence Vulnerability Report for updated remediation guidance.

Workarounds

• Deactivate the Starred Review plugin if it is not essential for site functionality
• Implement Content Security Policy headers to restrict inline script execution
• Deploy a WAF rule to block requests with suspicious patterns in the URI path targeting plugin pages
• Use WordPress hardening plugins that provide additional input validation and output encoding

# Apache .htaccess WAF rule to block common XSS patterns
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} (<|>|%3C|%3E|script|javascript) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Nginx configuration to add Content Security Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;