CVE-2025-14725: Internal Link Builder WordPress XSS Flaw

CVE-2025-14725 Overview

CVE-2025-14725 is a Stored Cross-Site Scripting (XSS) vulnerability in the Internal Link Builder plugin for WordPress. The flaw affects all versions up to and including 1.0. It stems from insufficient input sanitization and output escaping in the plugin's admin settings handler.

Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users visit affected pages. The issue is classified under [CWE-79]. Exploitation is limited to WordPress multi-site installations and single-site installations where the unfiltered_html capability has been explicitly disabled.

Critical Impact
Authenticated administrators on multi-site WordPress deployments can persist JavaScript payloads through plugin settings, enabling script execution against any visitor or privileged user accessing injected pages.

Affected Products

WordPress Internal Link Builder plugin versions ≤ 1.0
WordPress multi-site installations running the plugin
WordPress installations where unfiltered_html capability is disabled

Discovery Timeline

2026-01-14 - CVE-2025-14725 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-14725

Vulnerability Analysis

The Internal Link Builder plugin processes administrator-supplied settings without applying adequate input sanitization on storage or output escaping on render. Attacker-controlled values persist in the WordPress options table and are later emitted into administrative pages without contextual encoding.

The attack vector is network-based but requires high privileges and high attack complexity. The scope is changed because injected scripts execute in the browser context of any user visiting the injected page, including users distinct from the attacker. Confidentiality and integrity impacts are limited, with no direct availability impact.

The EPSS probability is 0.033%, indicating low predicted exploitation activity in the near term. The vulnerability is tracked under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is missing sanitization on input received through the plugin's admin settings handler, combined with absent output escaping when those values are rendered back into HTML contexts. Functions such as sanitize_text_field(), wp_kses(), or esc_html() are not consistently applied at the relevant boundaries in InternalLinkBuilder.php. See the WordPress Internal Link Builder Code for the affected handler.

Attack Vector

An attacker must first hold administrator credentials on the target site. On standard single-site WordPress installations, administrators already possess the unfiltered_html capability, which permits raw HTML in posts and settings — so this class of injection is not treated as a vulnerability there. On multi-site installations, only super administrators retain unfiltered_html by default, so a site-level administrator without that capability can leverage the plugin's missing sanitization to inject scripts that should otherwise be blocked. The same applies to hardened installations where unfiltered_html has been removed. Injected payloads persist in the database and execute whenever a user loads the affected page.

No verified public exploit code or proof-of-concept is available for this issue. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-14725

Indicators of Compromise

Unexpected <script> tags, event handler attributes, or JavaScript URIs stored in WordPress option rows belonging to the Internal Link Builder plugin
Outbound requests from administrator browsers to attacker-controlled domains after visiting plugin-managed pages
Audit log entries showing plugin settings modifications by non-super-administrator accounts on multi-site installs

Detection Strategies

Query the wp_options table for plugin-prefixed option names and inspect values for HTML or JavaScript content
Review the plugin source at line 133 of InternalLinkBuilder.php and grep webserver logs for POST requests to the plugin's settings endpoint
Correlate administrator session activity with subsequent script execution telemetry from browser endpoints

Monitoring Recommendations

Enable WordPress audit logging to capture all administrator-level settings changes, including diffs of modified option values
Monitor multi-site network administration consoles for new or modified plugin configurations applied by site-level administrators
Forward web server and WordPress application logs to a centralized analytics platform for retention and anomaly review

How to Mitigate CVE-2025-14725

Immediate Actions Required

Deactivate and remove the Internal Link Builder plugin on multi-site installations and on any single-site install where unfiltered_html is disabled
Audit administrator accounts on multi-site networks and remove unnecessary administrator privileges
Inspect existing plugin settings for stored HTML or JavaScript and clear any unexpected values

Patch Information

At the time of NVD publication on 2026-01-14, no fixed version has been published. All versions up to and including 1.0 remain affected. Monitor the WordPress plugin repository and the Wordfence advisory for a patched release.

Workarounds

Restrict the administrator role on multi-site networks and limit plugin configuration access to trusted super administrators
Deploy a web application firewall rule that blocks <script> and event-handler payloads submitted to the plugin's settings endpoint
Apply a Content Security Policy that disallows inline scripts on WordPress administrative pages to reduce execution impact

bash

# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate internal-link-builder
wp plugin delete internal-link-builder

# Verify unfiltered_html capability assignments on a multi-site network
wp eval 'foreach (get_users(["role"=>"administrator"]) as $u) { echo $u->user_login.": ".(user_can($u,"unfiltered_html")?"yes":"no").PHP_EOL; }'