CVE-2025-14506: ConvertForce Popup Builder XSS Vulnerability

CVE-2025-14506 Overview

The ConvertForce Popup Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg block's entrance_animation attribute. This vulnerability affects all versions up to and including 0.0.7 and stems from insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or above can exploit this flaw to inject arbitrary web scripts into pages, which execute whenever a user accesses the compromised page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, or malware distribution through compromised WordPress sites.

Affected Products

• ConvertForce Popup Builder plugin for WordPress versions up to and including 0.0.7
• WordPress sites utilizing the ConvertForce Popup Builder Gutenberg blocks
• Any WordPress installation with the vulnerable plugin version activated

Discovery Timeline

• 2026-01-10 - CVE-2025-14506 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-14506

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability resides in the ConvertForce Popup Builder plugin's handling of the entrance_animation attribute within its Gutenberg block implementation. The vulnerability exists because user-supplied input to this attribute is not properly sanitized before being stored in the database, nor is it adequately escaped when rendered on the page.

When an authenticated user with Author-level privileges or higher creates or edits content using the ConvertForce Popup Builder Gutenberg block, they can inject malicious JavaScript code through the entrance_animation attribute. This script is then stored in the WordPress database and executed in the browser of any user who views the affected page, including administrators.

The vulnerable code can be found in the plugin's Conversion.php file, specifically around lines 47 and 66, where the entrance_animation attribute is processed without sufficient security controls.

Root Cause

The root cause of this vulnerability is a classic input validation failure classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin fails to implement proper input sanitization when accepting the entrance_animation attribute value and does not apply adequate output escaping when rendering this value in the browser context. This allows attackers to bypass security controls and inject executable script content.

Attack Vector

The attack requires network access and authenticated access to the WordPress site with at least Author-level privileges. An attacker would create or modify a post or page using the Gutenberg editor, utilizing the ConvertForce Popup Builder block. By crafting a malicious payload in the entrance_animation attribute field, the attacker can embed JavaScript that persists in the database.

Once the malicious content is saved, any visitor to the affected page—including site administrators—will have the malicious script execute in their browser session. This can lead to session token theft, administrative account compromise, defacement, or redirection to malicious sites. The vulnerability does not require user interaction beyond normal page viewing, making it particularly dangerous for high-traffic WordPress sites.

Detection Methods for CVE-2025-14506

Indicators of Compromise

• Presence of unexpected JavaScript code or <script> tags within post content utilizing ConvertForce Popup Builder blocks
• Unusual values in the entrance_animation attribute containing encoded characters, event handlers, or script references
• Reports from users experiencing unexpected browser behavior, redirects, or pop-ups on specific pages
• Web Application Firewall logs showing blocked XSS attempts targeting the plugin's block attributes

Detection Strategies

• Implement content security policy (CSP) headers to detect and prevent unauthorized script execution
• Deploy web application firewall (WAF) rules specifically monitoring for XSS patterns in WordPress plugin parameters
• Conduct regular database audits searching for suspicious script content within post metadata and block attributes
• Enable WordPress audit logging to track post modifications by Author-level users

Monitoring Recommendations

• Monitor WordPress wp_posts and wp_postmeta tables for entries containing suspicious JavaScript patterns
• Set up alerts for unusual editing activity on posts containing ConvertForce Popup Builder blocks
• Review browser console errors and CSP violation reports that may indicate blocked XSS attempts
• Implement real-time file integrity monitoring for the ConvertForce Popup Builder plugin directory

How to Mitigate CVE-2025-14506

Immediate Actions Required

• Update the ConvertForce Popup Builder plugin to the latest patched version immediately
• Audit all existing posts and pages using the ConvertForce Popup Builder blocks for malicious content
• Temporarily disable the plugin if updating is not immediately possible
• Review user accounts with Author-level access and above for any unauthorized or suspicious accounts

Patch Information

A security patch addressing this vulnerability is available through WordPress Changeset 3419678. Site administrators should update to the patched version of ConvertForce Popup Builder through the WordPress plugin update mechanism. The patch implements proper input sanitization and output escaping for the entrance_animation attribute.

For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• If immediate patching is not possible, disable the ConvertForce Popup Builder plugin until the update can be applied
• Implement strict content security policy (CSP) headers to mitigate the impact of any injected scripts
• Restrict Author-level access to trusted users only and audit existing permissions
• Deploy a web application firewall with XSS protection rules to filter malicious input attempts

# WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate convertforce-popup-builder

# After updating, reactivate the plugin
wp plugin activate convertforce-popup-builder

# Verify the installed plugin version
wp plugin list --name=convertforce-popup-builder --fields=name,version,status