CVE-2025-14118: 
WordPress vulnerability analysis and mitigation

CVE-2025-14118 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Starred Review plugin for WordPress, affecting all versions up to and including 1.4.2. The flaw arises from insufficient input sanitization and output escaping of the PHP_SELF server variable. It was published on January 7, 2026, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerable code is located at line 29 of starred-review.php, where the PHP_SELF superglobal is echoed into the page without sanitization or escaping, allowing an attacker to inject arbitrary JavaScript via a crafted URL (Wordfence, WordPress Trac). Exploitation requires no authentication and no special privileges, but does require social engineering to trick a victim into clicking a malicious link. The attack vector is network-based with low complexity, and the scope is changed, meaning the injected script executes in the victim's browser context rather than the server's.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of a victim who clicks a crafted link. This can result in session cookie theft, credential harvesting, redirection to malicious sites, or defacement of the page as rendered in the victim's browser. Confidentiality and integrity are both assessed as low impact; availability is not affected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14118. The EPSS score is approximately 0.061%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Starred Review plugin version 1.4.2 or earlier using tools like WPScan or by inspecting plugin directories on target sites.
2. Craft malicious URL: Construct a URL targeting a page that loads the vulnerable starred-review.php script, appending a malicious payload via the path component that manipulates the PHP_SELF variable (e.g., https://victim-site.com/wp-content/plugins/starred-review/starred-review.php/<script>alert(document.cookie)</script>).
3. Deliver the link: Send the crafted URL to a target user via phishing email, social media, or another social engineering channel to induce them to click it.
4. Script execution: When the victim loads the page, the unsanitized PHP_SELF value is reflected into the HTML response, causing the injected script to execute in the victim's browser — enabling session theft, credential harvesting, or redirection to attacker-controlled infrastructure (Wordfence, WordPress Trac).

• Network: HTTP requests to starred-review.php with unusual path segments containing URL-encoded script tags or JavaScript payloads (e.g., %3Cscript%3E, <script>, onerror=, javascript:).
• Logs: Web server access logs showing GET requests to the plugin's PHP file with anomalous path info containing HTML/JavaScript characters.
• File System: No file-system changes are expected for reflected XSS; however, if the attacker achieves further access (e.g., via stolen admin session cookies), look for newly created or modified PHP files in the WordPress installation directory.

Users should update the Starred Review plugin to version 1.4.3 or later, which contains the fix for this vulnerability (Wordfence). If an immediate update is not possible, consider deactivating the plugin until patching can be performed. Web application firewalls (WAFs) with XSS filtering rules can provide an additional layer of defense against exploitation attempts.