CVE-2025-14280

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14280", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-08T17:15:54.201Z", "datePublished": "2025-12-29T18:20:49.929Z", "dateUpdated": "2026-04-08T16:35:52.110Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:35:52.110Z"}, "affected": [{"vendor": "pixelyoursite", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "11.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, when the \"Meta API logs\" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully patched in version 11.1.5.1."}], "title": "PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe77926-8a43-42ce-9d3d-3aac2334dcbd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.4.2/includes/logger/class-pys-logger.php#L118"}, {"url": "https://plugins.trac.wordpress.org/changeset/3424175/pixelyoursite"}, {"url": "https://plugins.trac.wordpress.org/changeset/3416113/pixelyoursite"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "timeline": [{"time": "2025-12-08T17:33:13.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-29T05:47:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-30T21:57:47.708348Z", "id": "CVE-2025-14280", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-30T22:30:31.768Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14280", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-30T21:57:47.708348Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-30T21:57:54.263Z"}}], "cna": {"title": "PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File", "credits": [{"lang": "en", "type": "finder", "value": "Marcin Dudek"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "pixelyoursite", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "11.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-08T17:33:13.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-29T05:47:53.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe77926-8a43-42ce-9d3d-3aac2334dcbd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.4.2/includes/logger/class-pys-logger.php#L118"}, {"url": "https://plugins.trac.wordpress.org/changeset/3424175/pixelyoursite"}, {"url": "https://plugins.trac.wordpress.org/changeset/3416113/pixelyoursite"}], "descriptions": [{"lang": "en", "value": "The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, when the \"Meta API logs\" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully patched in version 11.1.5.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-29T18:20:49.929Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14280", "state": "PUBLISHED", "dateUpdated": "2025-12-30T22:30:31.768Z", "dateReserved": "2025-12-08T17:15:54.201Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-29T18:20:49.929Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PixelYourSite \u2013 Your smart PIXEL (TAG) & API Manager", "vendor": "pixelyoursite", "versions": [{"lessThanOrEqual": "11.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, when the \"Meta API logs\" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully patched in version 11.1.5.1."}, {"lang": "es", "value": "El plugin PixelYourSite para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta, e incluyendo, la 11.1.5 a trav\u00e9s de archivos de registro expuestos p\u00fablicamente. Esto hace posible que atacantes no autenticados vean informaci\u00f3n potencialmente sensible contenida en los archivos de registro expuestos, cuando la configuraci\u00f3n Meta API logs est\u00e1 habilitada (deshabilitada por defecto). La vulnerabilidad fue parcheada parcialmente en la versi\u00f3n 11.1.5 y parcheada completamente en la versi\u00f3n 11.1.5.1."}], "id": "CVE-2025-14280", "lastModified": "2026-10-07T12:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14280", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-30T21:57:47.708348Z", "version": "2.0.3"}}]}, "published": "2025-12-29T19:15:54.870", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/pixelyoursite/tags/11.1.4.2/includes/logger/class-pys-logger.php#L118"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3416113/pixelyoursite"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3424175/pixelyoursite"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe77926-8a43-42ce-9d3d-3aac2334dcbd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:59:18.835125+00:00", "value": {"mitigation_remediation": ["Upgrade PixelYourSite to version 11.1.5.1.", "If an upgrade is not immediately possible, disable the \"Meta API logs\" setting to prevent log files from being generated or exposed.", "Verify that log files placed in the wp-content/uploads/pixelyoursite directory are not world\u2011readable; if they exist, delete or secure them."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "All versions of PixelYourSite up to and including 11.1.5 are affected. The vulnerability is resolved in 11.1.5.1; upgrading to that version removes the exposed log\u2011file path and stops the disclosure.", "description_and_impact": "The PixelYourSite WordPress plugin writes log files that, when the \"Meta API logs\" option is enabled, are accessible from the web. Unauthenticated attackers can read these files and obtain potentially confidential data. The weakness is a classic information\u2011exposure flaw identified as CWE\u2011200.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% reflects a very low likelihood of exploitation. Because the log files can be read over HTTP without authentication, the attack vector is unauthenticated network access, but in practice attackers would need to know the URL of the log file or rely on the credentials of a site administrator who has left the setting enabled."}}}}, "created": "2026-01-05T10:23:15.929212+00:00", "updated": "2026-04-22T16:00:12.109699+00:00", "vendors": ["pixelyoursite", "pixelyoursite$PRODUCT$pixelyoursite", "wordpress", "wordpress$PRODUCT$wordpress"]}