CVE-2025-14735
Stored XSS in Amazon Affiliate Lite Plugin Admin Settings
Publication date: 2025-12-20
Last updated on: 2025-12-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | affiliate_lite_plugin | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Amazon affiliate lite Plugin for WordPress. It occurs due to insufficient input sanitization and output escaping in admin settings, allowing authenticated users with administrator-level permissions to inject malicious scripts. These scripts execute whenever a user accesses the injected page. This affects multi-site installations and installations where unfiltered_html is disabled.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with administrator permissions to inject malicious scripts that execute in users' browsers. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of users visiting the affected pages.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Amazon affiliate lite Plugin for WordPress to a version later than 1.0.0 once available. Until then, restrict administrator-level permissions to trusted users only, ensure that unfiltered_html is enabled if possible, and avoid using multi-site installations with this plugin. Additionally, monitor and sanitize admin settings inputs to prevent injection of arbitrary scripts.