CVE-2025-14145 Overview
CVE-2025-14145 is a Stored Cross-Site Scripting (XSS) vulnerability in the Niche Hero WordPress plugin, which provides pre-designed content blocks for site builders. The flaw affects all plugin versions up to and including 1.0.5. It exists in the spacing parameter of the nh_row shortcode, where the plugin fails to sanitize input or escape output. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who views the affected page, enabling session theft, redirection, or unauthorized actions within the WordPress site context.
Critical Impact
Authenticated contributors can inject persistent JavaScript that runs in every visitor's browser, including administrators viewing affected pages.
Affected Products
- Niche Hero WordPress plugin versions through 1.0.5
- WordPress sites permitting Contributor-level or higher registration
- Any WordPress installation using the nh_row shortcode
Discovery Timeline
- 2026-01-07 - CVE-2025-14145 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-14145
Vulnerability Analysis
The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. The Niche Hero plugin registers an nh_row shortcode that accepts a spacing attribute used to control layout styling. The plugin reflects the spacing value directly into the rendered HTML output without applying sanitization functions such as sanitize_text_field() or escaping helpers such as esc_attr().
Because shortcode attributes are persisted in post content, the injected payload becomes stored XSS rather than reflected. Each subsequent page render serves the malicious payload to viewers. The attack scope is Changed under the CVSS vector, indicating the injected script executes in the security context of the WordPress origin rather than the attacker's context.
Root Cause
The plugin source at line 302 of niche-hero.php outputs the spacing shortcode attribute into the page markup without neutralizing HTML control characters. Attribute values containing quotes, angle brackets, or javascript: URIs break out of the intended attribute context and introduce executable script tags or event handlers.
Attack Vector
An authenticated Contributor crafts a post or page containing the nh_row shortcode with a malicious spacing value. After submission, the payload persists in wp_posts. When an editor previews the submission or a visitor loads the published page, the browser executes the attacker's JavaScript. The payload can exfiltrate cookies, perform CSRF actions against the WordPress REST API, or escalate privileges by creating new administrator accounts when an administrator views the page. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical references.
Detection Methods for CVE-2025-14145
Indicators of Compromise
- Stored nh_row shortcodes containing <script>, onerror=, onload=, or javascript: substrings within the spacing attribute.
- Unexpected administrator accounts or modified user roles created shortly after a Contributor submission was reviewed.
- Outbound browser requests from editor or visitor sessions to unknown domains after rendering plugin-driven pages.
Detection Strategies
- Query the wp_posts table for post_content matching nh_row shortcodes with suspicious spacing values using a LIKE pattern on %nh_row%spacing=%<%.
- Review web server access logs for requests to pages containing the plugin shortcode followed by anomalous outbound API calls.
- Inspect rendered HTML of plugin-driven pages for script tags or event handler attributes within layout containers.
Monitoring Recommendations
- Audit Contributor and Author submissions before publication, paying particular attention to shortcode parameters.
- Enable a Web Application Firewall rule that blocks shortcode attributes containing HTML tags or JavaScript URI schemes.
- Monitor for new WordPress user creation events and role escalations triggered from authenticated browser sessions.
How to Mitigate CVE-2025-14145
Immediate Actions Required
- Disable the Niche Hero plugin until a patched release is available and verified.
- Review existing posts and pages for nh_row shortcodes with unexpected spacing values and remove malicious content.
- Restrict Contributor-level account creation and audit existing low-privilege accounts for suspicious activity.
Patch Information
No fixed version has been published in the available references at the time of NVD publication. All releases through 1.0.5 remain vulnerable. Monitor the WordPress Plugin Development Code for an updated release that applies esc_attr() or equivalent escaping to the spacing parameter.
Workarounds
- Remove the plugin entirely if the nh_row shortcode is not in active use.
- Apply a WAF rule that strips or blocks shortcode attribute values containing <, >, or " characters before they reach WordPress.
- Require editor review and approval of all Contributor submissions, scanning shortcode parameters before publishing.
# Example WP-CLI command to locate vulnerable shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[nh_row%spacing=%'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
