CVE-2025-14554: Sell BTC WordPress Plugin XSS Vulnerability

CVE-2025-14554 Overview

The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the orderform_data AJAX action. All versions up to and including 1.5 are affected due to insufficient input sanitization and output escaping. This vulnerability enables unauthenticated attackers to inject arbitrary web scripts into order records, which execute whenever an administrator accesses the Orders page in the admin dashboard.

Critical Impact
Unauthenticated attackers can inject malicious scripts that execute in administrator sessions, potentially leading to account takeover, data theft, or further compromise of the WordPress installation.

Affected Products

Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress versions up to and including 1.5
WordPress installations using the vulnerable plugin
Sites with the Sell BTC plugin installed regardless of active usage

Discovery Timeline

2026-01-31 - CVE CVE-2025-14554 published to NVD
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-14554

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the order form processing functionality of the Sell BTC plugin. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). When users submit orders through the cryptocurrency calculator form, the plugin processes this data via the orderform_data AJAX action without proper sanitization. The malicious payload is stored in the database and later rendered on the admin Orders page without adequate output escaping, causing the injected script to execute in the context of an authenticated administrator's browser session.

The attack can be executed over the network without authentication, and the changed scope indicates that the vulnerability can affect resources beyond the vulnerable component itself. The impact includes potential compromise of confidentiality and integrity of the WordPress admin session.

Root Cause

The root cause is insufficient input sanitization in the orderform_data AJAX handler combined with missing output escaping when displaying order records in the admin dashboard. The vulnerable code paths can be traced through multiple plugin files including functions-admin.php, form_tab.php, and orders.php. User-supplied data from order submissions is stored directly to the database and subsequently echoed to the admin interface without proper encoding, allowing script injection.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft a malicious order submission containing JavaScript payloads in form fields that would normally contain customer information such as name, email, or transaction details. When a WordPress administrator navigates to the Orders page within the plugin's admin section, the stored payload executes within their authenticated session.

This stored XSS attack is particularly dangerous because:

The attacker does not need any WordPress credentials
The payload persists in the database until manually removed
The script executes with the full privileges of the viewing administrator
Multiple administrators could be affected by a single injection

Detection Methods for CVE-2025-14554

Indicators of Compromise

Unexpected JavaScript code present in order records within the wp_options or custom plugin tables
Anomalous AJAX requests to admin-ajax.php with action parameter orderform_data containing script tags or encoded payloads
Browser console errors or unexpected script execution when administrators access the plugin Orders page
Modified admin user accounts or unauthorized administrator accounts created

Detection Strategies

Monitor web application firewall (WAF) logs for XSS patterns in POST requests targeting admin-ajax.php with the orderform_data action
Implement Content Security Policy (CSP) headers to detect and block inline script execution
Review database entries for order data containing HTML tags, JavaScript events, or script elements
Enable WordPress debug logging to capture unexpected script executions in the admin area

Monitoring Recommendations

Configure real-time alerting for pattern-matched XSS payloads in AJAX requests to WordPress installations
Implement integrity monitoring on WordPress plugin files to detect unauthorized modifications
Monitor admin user session activity for anomalous behavior following Orders page access
Review server access logs for repeated order form submissions from single IP addresses

How to Mitigate CVE-2025-14554

Immediate Actions Required

Update the Sell BTC - Cryptocurrency Selling Calculator plugin beyond version 1.5 once a complete fix is available
Review existing order records in the database for suspicious content and sanitize any malicious entries
Implement a Web Application Firewall (WAF) with XSS filtering rules as an interim protection measure
Consider temporarily disabling the plugin if cryptocurrency selling functionality is not critical

Patch Information

The vulnerability was partially addressed in version 1.5 of the plugin. Patches have been committed to the WordPress plugin repository as documented in WordPress Changeset #3433480 and WordPress Changeset #3450361. Administrators should update to the latest available version and verify the fix addresses all injection points. Additional details about the vulnerability can be found in the Wordfence Vulnerability Report.

Workarounds

Restrict access to the WordPress admin dashboard to trusted IP addresses only until a complete patch is applied
Implement server-side input validation and output encoding at the web server or WAF level
Use a security plugin that provides virtual patching capabilities for known vulnerabilities
Disable the plugin's order form functionality if possible while maintaining other calculator features

bash

# Configuration example - Add to .htaccess to restrict admin access
<Files "admin-ajax.php">
    # Block suspicious XSS patterns in POST data
    SecRule REQUEST_BODY "@contains <script" "id:1001,phase:2,deny,status:403,msg:'XSS attempt blocked'"
    SecRule REQUEST_BODY "@contains javascript:" "id:1002,phase:2,deny,status:403,msg:'XSS attempt blocked'"
    SecRule ARGS:action "@streq orderform_data" "chain,id:1003,phase:2"
    SecRule REQUEST_BODY "@rx <[^>]*on\w+=" "deny,status:403,msg:'Event handler XSS blocked'"
</Files>