CVE-2025-14142: WordPress Electric Enquiries XSS Flaw

CVE-2025-14142 Overview

The Electric Enquiries plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the button parameter of the electric-enquiry shortcode. All versions up to and including 1.1 are affected due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. These malicious scripts execute whenever any user accesses the compromised page, potentially leading to session hijacking, credential theft, or further malicious actions.

Critical Impact

Authenticated attackers can persistently inject malicious JavaScript that executes in the browsers of all users viewing affected pages, enabling session hijacking and data theft.

Affected Products

• Electric Enquiries WordPress Plugin version 1.1 and earlier
• WordPress installations using the electric-enquiry shortcode functionality
• Any WordPress site with Contributor-level or higher user accounts using this plugin

Discovery Timeline

• 2026-02-27 - CVE CVE-2025-14142 published to NVD
• 2026-02-27 - Last updated in NVD database

Technical Details for CVE-2025-14142

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The Electric Enquiries plugin fails to properly sanitize user-supplied input in the button parameter of its shortcode implementation before rendering it in the page output.

When a user with Contributor-level access or higher creates or edits content using the electric-enquiry shortcode, they can inject malicious JavaScript code through the button parameter. Because the plugin does not adequately escape this input before outputting it to the page, the injected script becomes part of the rendered HTML and executes in the browser context of any visitor viewing that page.

The stored nature of this XSS vulnerability makes it particularly dangerous, as the malicious payload persists in the WordPress database and executes repeatedly for every page view without requiring further attacker interaction.

Root Cause

The root cause lies in the plugin's shortcode handling code, specifically at line 76 of electric-enquiries.php. The button parameter value is directly incorporated into the HTML output without proper sanitization using WordPress escaping functions such as esc_attr() or esc_html(). This allows HTML and JavaScript injection when rendering the shortcode output.

Attack Vector

The attack requires network access and authenticated access to the WordPress installation with at least Contributor-level privileges. An attacker can exploit this vulnerability by:

1. Creating or editing a post/page with the electric-enquiry shortcode
2. Injecting malicious JavaScript code into the button parameter
3. Publishing or saving the content for review
4. Waiting for victims (including administrators) to view the page containing the malicious shortcode

The injected script executes with the privileges of the victim's session, allowing the attacker to steal session cookies, perform actions on behalf of administrators, redirect users to phishing sites, or deface website content.

Detection Methods for CVE-2025-14142

Indicators of Compromise

• Unexpected JavaScript code or encoded script content within post/page content containing electric-enquiry shortcodes
• Suspicious <script> tags or event handlers (e.g., onload, onerror, onclick) appearing in the button parameter values
• Browser console errors or unexpected network requests when viewing pages with Electric Enquiries forms
• User reports of redirects to external sites or unusual pop-ups when viewing content with the plugin

Detection Strategies

• Search the WordPress database for electric-enquiry shortcodes containing suspicious patterns like <script>, javascript:, or HTML event handlers
• Implement Web Application Firewall (WAF) rules to detect XSS payloads in shortcode parameters
• Monitor plugin activity logs for content modifications by Contributor-level users that include the electric-enquiry shortcode
• Use security scanning plugins to detect stored XSS patterns in post content

Monitoring Recommendations

• Enable WordPress audit logging to track all post/page edits, particularly those involving shortcodes
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS attacks
• Regularly scan stored content for XSS indicators using automated security tools
• Monitor for unusual user behavior patterns, such as Contributors creating multiple posts with shortcodes

How to Mitigate CVE-2025-14142

Immediate Actions Required

• Review and audit all existing posts/pages containing electric-enquiry shortcodes for malicious content
• Consider disabling the Electric Enquiries plugin until an official patch is available
• Restrict Contributor-level access temporarily or limit shortcode usage capabilities
• Implement a WAF rule to filter XSS payloads targeting this specific parameter

Patch Information

As of the last update on 2026-02-27, review the Wordfence vulnerability report and the WordPress Plugin Repository for the latest version information and any available security updates. Update to the latest version of the Electric Enquiries plugin once a patched version is released.

Workarounds

• Deactivate the Electric Enquiries plugin if it is not critical to site operations
• Implement server-side input filtering using .htaccess or web server configuration to block requests containing XSS patterns
• Use a security plugin with real-time XSS protection capabilities
• Remove Contributor-level access from untrusted users until the vulnerability is patched

# Configuration example - Add to WordPress wp-config.php to restrict shortcode usage
# This disables shortcodes for non-admin users (use with caution)
# Note: This is a workaround and may affect legitimate functionality

# Add CSP headers via .htaccess to mitigate XSS impact
# Place in WordPress root .htaccess file:
Header set Content-Security-Policy "script-src 'self'; object-src 'none';"