CVE-2025-14792: Key Figures WordPress Plugin XSS Flaw

CVE-2025-14792 Overview

The Key Figures plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the kf_field_figure_default_color_render function. This security flaw exists in all versions up to and including 1.1 due to insufficient input sanitization and output escaping. The vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

This vulnerability enables persistent script injection attacks that can compromise user sessions, steal credentials, or perform unauthorized actions on behalf of legitimate users. The impact is specifically relevant to WordPress multi-site installations and instances where unfiltered_html has been disabled.

Affected Products

• WordPress Key Figures Plugin versions up to and including 1.1
• WordPress Multi-site installations with Key Figures plugin
• WordPress installations where unfiltered_html has been disabled

Discovery Timeline

• 2026-01-07 - CVE CVE-2025-14792 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-14792

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability is classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). The vulnerability exists in the admin settings interface of the Key Figures plugin, specifically within the kf_field_figure_default_color_render function located in admin/kf-admin.php at line 201.

The attack requires network access and high-privilege authentication (administrator-level), with high attack complexity due to its limitation to specific WordPress configurations. Despite requiring elevated privileges, the vulnerability can affect resources beyond the vulnerable component (changed scope), potentially impacting confidentiality and integrity of the broader WordPress installation.

Root Cause

The root cause stems from improper input sanitization and missing output escaping in the kf_field_figure_default_color_render function. When administrators configure the default color settings for key figures, the plugin fails to properly sanitize user-supplied input before storing it in the database and does not escape the output when rendering the value back to pages. This allows malicious JavaScript code to be persisted and executed in the context of other users' browser sessions.

Attack Vector

The attack vector requires an authenticated attacker with administrator privileges to exploit this vulnerability through network access. The attacker must inject malicious JavaScript code through the plugin's color configuration settings. Once stored, the payload executes whenever any user accesses a page containing the injected content.

The vulnerability specifically affects:

• WordPress multi-site installations where administrators may not have full trust
• Single-site installations where the unfiltered_html capability has been explicitly disabled for administrators

In these configurations, the plugin's lack of sanitization bypasses WordPress's built-in XSS protections, allowing script injection that would otherwise be blocked.

Detection Methods for CVE-2025-14792

Indicators of Compromise

• Unexpected JavaScript code in Key Figures plugin database settings
• Anomalous script execution on pages containing Key Figures elements
• Browser console errors indicating blocked cross-origin requests from injected scripts
• Unusual modifications to the kf_field_figure_default_color option in the WordPress options table

Detection Strategies

• Review WordPress options table for suspicious entries related to the Key Figures plugin
• Monitor web application firewall (WAF) logs for XSS payload patterns in admin requests
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Audit administrator activity logs for modifications to Key Figures plugin settings

Monitoring Recommendations

• Enable WordPress audit logging to track changes to plugin settings
• Configure server-side logging to capture POST requests to Key Figures admin endpoints
• Deploy browser-based XSS detection tools that alert on suspicious script execution
• Monitor for unexpected DOM modifications on pages using Key Figures shortcodes

How to Mitigate CVE-2025-14792

Immediate Actions Required

• Audit current Key Figures plugin settings for any suspicious content in color configuration fields
• Review administrator accounts for any unauthorized or compromised credentials
• Consider temporarily disabling the Key Figures plugin until a patched version is available
• Implement a Web Application Firewall (WAF) with XSS protection rules

Patch Information

As of the last update, users should monitor the WordPress Plugin Repository and Wordfence Vulnerability Report for updates. Users should update to a patched version when available from the plugin developer. Until then, the workarounds below can help reduce risk.

Workarounds

• Restrict administrator access to only trusted users on multi-site installations
• Enable the unfiltered_html capability for trusted administrators to bypass this specific attack path (note: this has other security implications)
• Implement Content Security Policy headers to prevent inline script execution
• Use a WordPress security plugin with XSS filtering capabilities to sanitize stored content

# WordPress wp-config.php hardening example
# Add to wp-config.php to restrict admin capabilities on multisite

# Disable file editing from admin panel
define('DISALLOW_FILE_EDIT', true);

# Force SSL for admin area
define('FORCE_SSL_ADMIN', true);

# Limit login attempts (requires additional plugin)
# Consider using a security plugin like Wordfence for comprehensive protection