CVE-2025-14113: 
WordPress vulnerability analysis and mitigation

CVE-2025-14113 is a Stored Cross-Site Scripting (XSS) vulnerability in the Viitor Button Shortcodes plugin for WordPress, affecting all versions up to and including 3.0.0. The flaw arises from insufficient input sanitization and output escaping of the link shortcode attribute, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. It was disclosed on January 7, 2026, with Wordfence as the CNA. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerable code is located in includes/class-ww-vcsc-shortcodes.php at line 51, where the link attribute passed to the button shortcode is rendered without proper sanitization or escaping (WordPress Trac). An attacker with at least Contributor-level WordPress access can craft a post or page containing a malicious shortcode payload (e.g., [viitor_button link="javascript:alert(1)"]) that executes in the browsers of any user who visits the affected page. No user interaction beyond page visitation is required for the injected script to execute (Wordfence).

Successful exploitation allows injected scripts to execute in the context of any visitor's browser session on the affected WordPress site, enabling session hijacking, credential theft, defacement, or redirection to malicious sites. The scope is changed (S:C in CVSS terms), meaning the impact extends beyond the attacker's own session to affect all users who view the compromised page. Confidentiality and integrity are both partially impacted, while availability is unaffected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14113. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running Viitor Button Shortcodes ≤ 3.0.0.
2. Create or Edit a Post: Navigate to the WordPress editor and create a new post or page (or edit an existing draft).
3. Inject Malicious Shortcode: Insert a crafted shortcode payload into the post content, such as [viitor_button link="javascript:alert(document.cookie)"] or a more sophisticated payload that exfiltrates session cookies to an attacker-controlled server.
4. Publish the Post: Submit the post for review or publish it (depending on role permissions). The malicious shortcode is stored in the WordPress database without sanitization.
5. Trigger Execution: When any site visitor (including administrators) loads the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session tokens or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing shortcode content with javascript: URIs or encoded script tags in the link parameter.
• Database: WordPress wp_posts table entries containing shortcode attributes with javascript:, <script>, or obfuscated payloads (e.g., javascript:) in the link field of [viitor_button] shortcodes.
• Network: Outbound HTTP requests from visitor browsers to unexpected external domains shortly after loading pages containing the Viitor Button Shortcodes plugin output, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to plugin files in wp-content/plugins/viitor-shortcodes/ if an attacker escalated access to modify plugin code directly.

Users should update the Viitor Button Shortcodes plugin to version 3.0.1 or later, which addresses the insufficient sanitization of the link shortcode attribute (Wordfence). As a temporary workaround, site administrators can restrict Contributor-level users from publishing content without review, or disable the plugin until patching is feasible. Web application firewalls (WAFs) with XSS filtering rules, such as those provided by Wordfence, can help block exploitation attempts in the interim.