CVE-2025-14053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14053", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-04T17:45:36.956Z", "datePublished": "2026-01-07T09:20:51.003Z", "dateUpdated": "2026-04-08T16:32:43.444Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:32:43.444Z"}, "affected": [{"vendor": "jseto", "product": "Travel Bucket List \u2013 Wish To Go", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Travel Bucket List <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02b9450e-422f-45f1-a55b-cf401e39247c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wish-to-go/trunk/wish-to-go.php#L124"}, {"url": "https://plugins.trac.wordpress.org/browser/wish-to-go/tags/0.5.2/wish-to-go.php#L124"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Camilla Flocco"}], "timeline": [{"time": "2026-01-06T20:47:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T16:12:56.339473Z", "id": "CVE-2025-14053", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:13:06.651Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14053", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T16:12:56.339473Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:13:01.208Z"}}], "cna": {"title": "Travel Bucket List <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Camilla Flocco"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jseto", "product": "Travel Bucket List \u2013 Wish To Go", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "0.5.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-06T20:47:44.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02b9450e-422f-45f1-a55b-cf401e39247c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wish-to-go/trunk/wish-to-go.php#L124"}, {"url": "https://plugins.trac.wordpress.org/browser/wish-to-go/tags/0.5.2/wish-to-go.php#L124"}], "descriptions": [{"lang": "en", "value": "The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-07T09:20:51.003Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14053", "state": "PUBLISHED", "dateUpdated": "2026-01-07T16:13:06.651Z", "dateReserved": "2025-12-04T17:45:36.956Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T09:20:51.003Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Travel Bucket List \u2013 Wish To Go", "vendor": "jseto", "versions": [{"lessThanOrEqual": "0.5.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Wish To Go para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de atributos de shortcode en todas las versiones hasta la 0.5.2, inclusive, debido a la sanitizaci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-14053", "lastModified": "2026-06-17T08:35:14.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14053", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T16:12:56.339473Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:51.347", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wish-to-go/tags/0.5.2/wish-to-go.php#L124"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wish-to-go/trunk/wish-to-go.php#L124"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/02b9450e-422f-45f1-a55b-cf401e39247c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T21:49:34.095758+00:00", "value": {"mitigation_remediation": ["Visit the plugin\u2019s official source or vendor site to locate a patched version that addresses the XSS flaw.", "Implement a server\u2011side filter that sanitizes shortcode attributes before they are saved, using WordPress functions such as sanitize_text_field() or esc_attr().", "Review the user roles and revoke Contributor permissions from accounts that do not require editing of content with shortcodes, or restrict their access to non\u2011shortcode authorship.", "As an interim measure, disable the Travel Bucket List \u2013 Wish To Go plugin or delete existing vulnerable shortcodes from posts until a patch is applied."], "summary": {"action": "Apply Fix", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All releases of jseto's Travel Bucket List \u2013 Wish To Go plugin up to and including version 0.5.2 are affected. The flaw can be exploited only on sites that use this plugin and have users with Contributor or higher roles who can create or edit content containing shortcodes.", "description_and_impact": "The Wish To Go plugin for WordPress contains a stored cross\u2011site scripting vulnerability in its shortcode attributes. Unsanitized user input is stored in the database and rendered directly when a page containing the shortcode is loaded, allowing a logged\u2011in attacker with Contributor or higher privileges to inject arbitrary JavaScript that will execute in the browsers of anyone who views the affected page.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication with at least Contributor privileges to add or edit a shortcode, after which the malicious script is stored and will run for any visitor who opens the associated page."}}}}, "created": "2026-01-08T09:49:12.122531+00:00", "updated": "2026-04-27T22:00:16.530820+00:00", "vendors": ["jseto", "jseto$PRODUCT$travel_bucket_list_wish_to_go", "wordpress", "wordpress$PRODUCT$wordpress"]}