CVE-2025-14785: SeedProd WordPress Plugin XSS Flaw

CVE-2025-14785 Overview

CVE-2025-14785 is a Stored Cross-Site Scripting (XSS) vulnerability in the Website Builder by SeedProd plugin for WordPress. The flaw affects all versions up to and including 6.20.2 and resides in the plugin's seedprodnestedmenuwidget shortcode. The plugin fails to sanitize user-supplied attributes and does not escape output correctly. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who loads the affected page. The issue is tracked under CWE-79.

Critical Impact
Contributor-level accounts can persist JavaScript payloads in WordPress pages, enabling session theft, administrative action forgery, and drive-by redirects against site visitors and administrators.

Affected Products

Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress
All versions up to and including 6.20.2
WordPress sites permitting contributor-level or higher registration

Discovery Timeline

2026-07-08 - CVE-2025-14785 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2025-14785

Vulnerability Analysis

The SeedProd plugin exposes a shortcode named seedprodnestedmenuwidget, implemented in app/nestednavmenu.php. Shortcode attributes supplied by the content author flow into the rendered HTML without adequate sanitization or output escaping. A contributor can craft a page containing the shortcode with malicious attribute values that break out of the intended HTML context. When the page renders, the browser interprets the payload as JavaScript rather than data. Because the payload is stored in the database and served to every visitor, exploitation persists until the content is removed.

Root Cause

The root cause is missing input sanitization on shortcode attributes combined with improper output escaping in the widget's render path. Neither sanitize_text_field()-style filtering on input nor esc_attr() / esc_html() on output is applied to the affected attribute values. This is a classic Stored XSS pattern classified under CWE-79. The upstream fix is visible in the WordPress Plugin Change Log.

Attack Vector

An attacker first obtains a contributor account, either through open registration, credential theft, or social engineering. The attacker then creates or edits a post containing the seedprodnestedmenuwidget shortcode with a crafted attribute carrying JavaScript. Once the post is published or previewed, the payload executes in the browser of any user viewing the page, including administrators. This can lead to session hijacking, forced administrative actions, backdoor plugin installation, or redirection to malware. Attack complexity is low and no user interaction beyond visiting the page is required.

No public proof-of-concept exploit is currently available. Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-14785

Indicators of Compromise

Occurrences of the seedprodnestedmenuwidget shortcode in wp_posts content containing <script>, javascript:, or event handler substrings such as onerror= or onload=.
New or modified posts authored by contributor-level accounts shortly before administrative session anomalies.
Outbound requests from visitor browsers to unfamiliar domains originating from pages that embed the vulnerable shortcode.
Unexpected creation of administrator accounts, plugin installations, or wp_options changes following visits to affected pages.

Detection Strategies

Query the WordPress database for posts containing [seedprodnestedmenuwidget and inspect attribute values for HTML or script content.
Enable a Content Security Policy (CSP) in report-only mode and review violations tied to inline script execution on pages containing the shortcode.
Audit user role assignments to identify unexpected contributor, author, or editor accounts.

Monitoring Recommendations

Monitor WordPress audit logs for post creation and revision events from low-privilege accounts.
Alert on administrative actions such as user creation or plugin installation that occur within a short window of an administrator viewing a contributor-authored page.
Track file integrity of the coming-soon plugin directory to detect tampering with app/nestednavmenu.php.

How to Mitigate CVE-2025-14785

Immediate Actions Required

Update the Website Builder by SeedProd plugin to a version later than 6.20.2 that includes the fix from changeset 3565979.
Audit all existing posts and pages for the seedprodnestedmenuwidget shortcode and review attribute values for injected script.
Review contributor, author, and editor accounts and revoke any that are unknown or unused.
Force a password reset for privileged WordPress accounts if suspicious content is found.

Patch Information

The vendor patched the vulnerability in app/nestednavmenu.php via WordPress plugin repository changeset 3565979. Site operators should upgrade through the WordPress admin plugin updater or by replacing the plugin files with the fixed release. Confirm the installed version is greater than 6.20.2 after upgrading.

Workarounds

Deactivate the SeedProd plugin until the patched version can be deployed if immediate upgrade is not possible.
Restrict contributor and author registration and require administrator approval for new low-privilege accounts.
Deploy a Web Application Firewall (WAF) rule blocking shortcode attributes that contain <script, javascript:, or HTML event handler patterns.
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored payloads.

bash

# Verify the installed SeedProd plugin version using WP-CLI
wp plugin get coming-soon --field=version

# Update the plugin to the patched release
wp plugin update coming-soon

# Search the database for potentially malicious shortcode usage
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[seedprodnestedmenuwidget%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%javascript:%' \
       OR post_content LIKE '%onerror=%');"