CVE-2025-14142

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14142", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-05T18:09:21.725Z", "datePublished": "2026-02-27T09:23:42.947Z", "dateUpdated": "2026-04-08T16:44:42.086Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:42.086Z"}, "affected": [{"vendor": "electriccode", "product": "Electric Enquiries", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Electric Enquiries <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f99da73-1db9-43ee-ac74-b772882baf15?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/electric-enquiries/trunk/electric-enquiries.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/electric-enquiries/tags/1.1/electric-enquiries.php#L76"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2026-02-26T20:48:35.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T15:45:42.657311Z", "id": "CVE-2025-14142", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T15:56:02.212Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14142", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T15:45:42.657311Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T15:55:56.716Z"}}], "cna": {"title": "Electric Enquiries <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "electriccode", "product": "Electric Enquiries", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-26T20:48:35.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f99da73-1db9-43ee-ac74-b772882baf15?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/electric-enquiries/trunk/electric-enquiries.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/electric-enquiries/tags/1.1/electric-enquiries.php#L76"}], "descriptions": [{"lang": "en", "value": "The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:42.086Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14142", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:44:42.086Z", "dateReserved": "2025-12-05T18:09:21.725Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-27T09:23:42.947Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Electric Enquiries", "vendor": "electriccode", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Electric Enquiries plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button' parameter of the electric-enquiry shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Electric Enquiries para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'button' del shortcode electric-enquiry en todas las versiones hasta la 1.1, inclusive, debido a la sanitizaci\u00f3n insuficiente de la entrada y el escape de la salida. Esto permite a atacantes autenticados, con acceso de nivel Colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-14142", "lastModified": "2026-06-17T08:35:24.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14142", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T15:45:42.657311Z", "version": "2.0.3"}}]}, "published": "2026-02-27T10:16:21.670", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/electric-enquiries/tags/1.1/electric-enquiries.php#L76"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/electric-enquiries/trunk/electric-enquiries.php#L76"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f99da73-1db9-43ee-ac74-b772882baf15?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Electric Enquiries", "source": "cna", "vendor": "electriccode"}, "product": "electric_enquiries", "vendor": "electriccode"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-27T20:05:49.429344+00:00", "value": {"mitigation_remediation": ["Update the Electric Enquiries plugin to a version newer than 1.1, which removes the vulnerability.", "If an update is not immediately possible, restrict the Contributor role to prevent editing of the electric\u2011enquiry shortcode or disable the shortcode entirely for untrusted users.", "Apply a content security policy (CSP) that blocks execution of inline scripts on the site to mitigate the impact of any remaining stored JavaScript."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting executing arbitrary web scripts in pages viewed by users"}, "threat_synthesis": {"affected_systems": "All installations of the Electric Enquiries plugin version 1.1 and earlier. The plugin is distributed by Electric code and is a normal WordPress plugin, so any WordPress site that has the plugin activated and includes the electric\u2011enquiry shortcode is at risk. The vulnerability is limited to sites where users can access the plugin\u2019s shortcode editor or configuration pages. Any WordPress instance using one of these affected plugin versions is impacted.", "description_and_impact": "The Electric Enquiries WordPress plugin allows authenticated users with Contributor level or higher to inject malicious JavaScript through the 'button' attribute of the electric\u2011enquiry shortcode. The input is stored without proper sanitization or escaping, so the injected script persists in the database and runs whenever a page containing the shortcode is rendered. This flaw enables client\u2011side compromise such as cookie theft, session hijacking, phishing, or defacement, and it affects the confidentiality, integrity, and availability of the website contents for all users who view the page. The weakness is a classic Stored XSS (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not currently listed in CISA KEV. An authenticated attacker with Contributor or higher privileges can inject malicious scripts via the button attribute, which are stored and executed when a user visits a page containing the shortcode. The attack vector requires only standard WordPress authentication at Contributor level and does not involve remote code execution on the server."}}}}, "created": "2026-02-27T16:05:51.647379+00:00", "updated": "2026-04-27T20:15:12.264534+00:00", "vendors": ["electriccode", "electriccode$PRODUCT$electric_enquiries", "wordpress", "wordpress$PRODUCT$wordpress"]}