CVE-2025-14725
Stored XSS in Internal Link Builder Plugin for WordPress Multisite
Publication date: 2026-01-14
Last updated on: 2026-01-14
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| internal_link_builder | plugin | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your WordPress installation is not using the Internal Link Builder plugin version 1.0 or earlier. If you are using a vulnerable version, update or remove the plugin. Additionally, restrict administrator-level permissions to trusted users only, and verify that unfiltered_html is enabled if possible. Since this vulnerability affects only multi-site installations and those with unfiltered_html disabled, consider these configurations as part of your mitigation strategy.
Can you explain this vulnerability to me?
The Internal Link Builder plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 1.0. This occurs because the plugin does not properly sanitize input or escape output in admin settings. Authenticated users with administrator-level permissions or higher can inject malicious scripts that execute when other users access the affected pages. This vulnerability affects only multi-site installations or those where unfiltered_html is disabled.
How can this vulnerability impact me? :
This vulnerability allows attackers with admin-level access to inject malicious scripts into pages, which execute when other users view those pages. This can lead to unauthorized actions, data theft, session hijacking, or other malicious activities affecting users and site integrity.