CVE-2025-14144 Overview
CVE-2025-14144 is a Stored Cross-Site Scripting (XSS) vulnerability in the Mstoic Shortcodes plugin for WordPress. The flaw exists in the start parameter of the ms_youtube_embeds shortcode in all versions up to and including 2.0. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or above to inject arbitrary web scripts. Injected scripts execute in the browser of any user who views the affected page. The issue is classified as Improper Neutralization of Input During Web Page Generation [CWE-79].
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and arbitrary actions in the victim's browser context.
Affected Products
- Mstoic Shortcodes plugin for WordPress — all versions through 2.0
- WordPress sites permitting Contributor-level account registration
- Sites embedding YouTube content via the ms_youtube_embeds shortcode
Discovery Timeline
- 2026-01-07 - CVE-2025-14144 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-14144
Vulnerability Analysis
The vulnerability resides in the ms_youtube_embeds shortcode handler in functions/shortcodes/youtube_embeds.php. The shortcode accepts a start attribute intended to set the YouTube playback start time. The plugin renders this attribute into the page output without performing sanitization on input or escaping on output. An attacker supplies a crafted start value containing HTML or JavaScript payloads. WordPress stores the shortcode in post content, and the malicious payload executes whenever the post or page is rendered. The attack persists across sessions, affecting every visitor to the injected page. Contributors normally lack the unfiltered_html capability, so this output-context flaw bypasses WordPress's standard role-based content filtering.
Root Cause
The root cause is missing input sanitization and missing output escaping on a user-controllable shortcode attribute. Secure WordPress development requires functions such as esc_attr(), esc_url(), or absint() for numeric values like a YouTube start offset. The plugin concatenates the raw start parameter directly into the rendered embed markup. Because start represents a playback time in seconds, casting to an integer with absint() would eliminate the injection vector entirely.
Attack Vector
The attack requires authenticated access at Contributor level or above. The attacker creates or edits a post and inserts the ms_youtube_embeds shortcode with a malicious start attribute containing JavaScript-bearing HTML. After the post is published or previewed by a privileged user, the script executes in their browser. This enables session cookie theft, forced administrative actions through CSRF chaining, redirection to attacker-controlled domains, or further privilege escalation if an administrator views the content. The scope-changed nature of the issue means the injected script affects a security boundary beyond the attacker's own account.
No verified public exploit code is available. See the Wordfence Vulnerability Analysis and the WordPress Shortcode Function source for technical context.
Detection Methods for CVE-2025-14144
Indicators of Compromise
- Post or page content containing ms_youtube_embeds shortcodes with non-numeric values in the start attribute.
- Database entries in wp_posts.post_content matching patterns such as start="<script or start='" followed by HTML tags or event handlers.
- Unexpected outbound requests from visitor browsers to unknown domains after viewing pages containing the shortcode.
- New or modified Contributor accounts publishing content that uses the vulnerable shortcode.
Detection Strategies
- Audit wp_posts for shortcodes where the start parameter contains characters outside 0-9.
- Review WordPress audit logs for Contributor-level users editing posts containing embed shortcodes.
- Deploy a web application firewall ruleset matching XSS payloads in WordPress POST bodies to post.php and admin-ajax.php.
Monitoring Recommendations
- Forward WordPress access and authentication logs to a centralized analytics platform for correlation.
- Alert on Content Security Policy (CSP) violation reports from inline script execution on content pages.
- Track creation of low-privilege accounts followed by rapid post-publishing activity.
How to Mitigate CVE-2025-14144
Immediate Actions Required
- Deactivate the Mstoic Shortcodes plugin until a patched release is installed and verified.
- Restrict Contributor and Author role assignment to trusted users and disable open user registration where possible.
- Scan existing post content for malicious ms_youtube_embeds shortcode usage and remove or sanitize affected entries.
- Force password resets and invalidate active sessions for any account that may have viewed injected pages with elevated privileges.
Patch Information
No fixed version is identified in the NVD record at the time of publication. Monitor the plugin's WordPress.org listing and the Wordfence Vulnerability Analysis entry for an updated release. Apply the vendor patch immediately once it becomes available and confirm the start parameter is cast to an integer in youtube_embeds.php.
Workarounds
- Remove the ms_youtube_embeds shortcode from active templates and posts until a patched version is released.
- Implement a strict Content Security Policy that disallows inline script execution on front-end pages.
- Use a web application firewall rule to block requests containing start= values with non-numeric characters in shortcode contexts.
- Downgrade Contributor accounts to Subscriber where post-creation privileges are not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.