CVE-2025-14154
Stored XSS in Better Messages WordPress Plugin Allows Script Injection
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | wordpress | * |
| wordfence | better_messages | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability allows attackers to execute arbitrary web scripts in the context of users visiting the affected pages. This can lead to theft of user credentials, session hijacking, defacement, or distribution of malware. Since the attacker does not need to be authenticated, it increases the risk of widespread exploitation.
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Better Messages plugin for WordPress and related platforms. It occurs because the plugin does not properly sanitize and escape input from guest display names. As a result, an unauthenticated attacker can inject malicious scripts into pages, which then execute whenever a user views those pages.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying stored cross-site scripting payloads in guest display names within the Better Messages plugin. You can inspect the database entries or web pages where guest names are displayed for suspicious script tags or unusual input. For example, using command-line tools like curl or wget to fetch pages and grep to search for script tags in guest names may help. However, no specific detection commands are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Better Messages plugin to version 2.10.3 or later, where the guest display name input is sanitized using the sanitize_user() function, preventing injection of malicious scripts. This update addresses the insufficient input sanitization and output escaping that caused the vulnerability. [2]