CVE-2025-14114: 
WordPress vulnerability analysis and mitigation

CVE-2025-14114 is a Stored Cross-Site Scripting (XSS) vulnerability in the 1180px Shortcodes plugin for WordPress, affecting all versions up to and including 1.1.1. The flaw arises from insufficient input sanitization and output escaping of the class shortcode attribute, allowing authenticated attackers with Contributor-level access or higher to inject persistent malicious scripts into pages. It was disclosed on January 7, 2026, by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerable code is located in 1180px.php at line 115, where the class attribute passed to a shortcode is rendered into the HTML output without proper sanitization or escaping (Plugin Source). An attacker with at least Contributor-level WordPress access can craft a post or page containing a malicious shortcode with a JavaScript payload embedded in the class attribute. The injected script is stored server-side and executes in the browser of any user who visits the affected page, with no additional user interaction required beyond page access (Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement, or delivery of drive-by malware to site visitors. The scope is changed (S:C in CVSS), meaning the impact extends beyond the attacker's own session to affect all users viewing the compromised content, with low confidentiality and integrity impact per the CVSS assessment (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14114. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the 1180px Shortcodes plugin version 1.1.1 or earlier. This can be done by checking plugin readme files or version indicators exposed in the site's HTML source.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a shortcode using the plugin's syntax with a malicious JavaScript payload in the class attribute, e.g., [shortcode class="\" onmouseover=\"alert(document.cookie)\""] or similar XSS payload.
4. Publish Content: Submit the post for review or publish it (depending on role permissions). The malicious payload is stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from Contributor-level accounts containing unusual class attribute values with JavaScript syntax (e.g., <script>, onerror=, onmouseover=).
• Database: WordPress wp_posts table entries containing shortcode markup with unsanitized class attributes embedding JavaScript payloads.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits, potentially visible in web proxy or firewall logs.
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than the file system.

WordPress site administrators should update the 1180px Shortcodes plugin to version 1.1.2 or later, which addresses the insufficient sanitization of the class shortcode attribute (Wordfence). If an immediate update is not possible, consider disabling the plugin or restricting Contributor-level user registration until the patch is applied. Site administrators should also audit existing posts and pages for any suspicious shortcode usage with unexpected class attribute values.

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for January 5–11, 2026, as part of their routine threat intelligence coverage (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the standard disclosure has been identified for this vulnerability.