CVE-2025-14138: 
WordPress vulnerability analysis and mitigation

CVE-2025-14138 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WPLG Default Mail From plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw stems from insufficient input sanitization and output escaping of the $_SERVER['PHP_SELF'] variable, allowing unauthenticated attackers to inject arbitrary web scripts. It was published on December 12, 2025, with the advisory assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin directly reflects the value of $_SERVER['PHP_SELF'] — a PHP superglobal containing the current script's path — into the page output without sanitization or escaping, as visible in the plugin source at line 134 of wplg.php. An attacker can craft a malicious URL containing a script payload in the path component, which gets embedded into the page when a victim visits the link. Exploitation requires no authentication but does require user interaction (i.e., a victim must click the crafted link) (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, defacement of page content as seen by the victim, or redirection to malicious sites. The confidentiality and integrity impacts are rated Low, with no direct availability impact; however, chained with social engineering, the attack surface extends to any authenticated user — including administrators — who can be tricked into clicking a malicious link (Red Hat Advisory, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14138 as of the available data. The EPSS score is approximately 0.082%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick a user into clicking a crafted URL, which limits opportunistic mass exploitation (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WPLG Default Mail From plugin (version ≤ 1.0.0) using tools like WPScan or by checking publicly accessible plugin directories.
2. Craft malicious URL: Construct a URL targeting a page rendered by the vulnerable plugin, appending a script payload in the path component that exploits the unsanitized $_SERVER['PHP_SELF'] variable — for example: https://target.com/wp-admin/options-general.php/<script>alert(document.cookie)</script>.
3. Deliver the payload: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, forum post, or other social engineering channel.
4. Trigger execution: When the victim clicks the link and loads the page, the injected script executes in their browser within the context of the WordPress site.
5. Achieve objective: Harvest session cookies, capture credentials, redirect the victim, or perform actions on behalf of the authenticated user (Wordfence, WordPress Trac).

• Network: HTTP requests to WordPress admin or plugin pages containing URL-encoded script tags or JavaScript payloads in the path component (e.g., /<script>, /%3Cscript%3E) targeting pages served by the WPLG Default Mail From plugin.
• Logs: Web server access logs showing unusual GET requests with script injection patterns in the URI path to plugin-related endpoints; referrer headers pointing to external phishing domains.
• File System: No direct file system artifacts expected for reflected XSS; however, monitor for unexpected changes to WordPress files if an attacker escalates privileges post-exploitation.

Users should update the WPLG Default Mail From plugin to a version beyond 1.0.0 that includes proper sanitization and escaping of the $_SERVER['PHP_SELF'] variable. If no patched version is yet available through the WordPress plugin repository, the plugin should be deactivated and removed until a fix is released. As a general defense-in-depth measure, deploying a Web Application Firewall (WAF) with XSS filtering rules can help block crafted payloads before they reach the application (Wordfence).