CVE-2025-14438

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14438", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T11:23:17.347Z", "datePublished": "2026-01-06T04:31:56.281Z", "dateUpdated": "2026-04-08T17:00:45.483Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:45.483Z"}, "affected": [{"vendor": "xagio", "product": "Xagio SEO \u2013 AI Powered SEO", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.1.0.30", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Xagio SEO \u2013 AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixabayDownloadImage' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "Xagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72779dd2-04eb-445d-88a0-28a9c4d2369b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/inc/xagio_core.php#L236"}, {"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/modules/seo/models/xagio_tinymce.php#L91"}, {"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/modules/seo/models/xagio_tinymce.php#L135"}, {"url": "https://plugins.trac.wordpress.org/changeset/3426300/xagio-seo#file374"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jack Taylor"}], "timeline": [{"time": "2026-01-05T16:06:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:35:32.285523Z", "id": "CVE-2025-14438", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:35:41.962Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14438", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:35:32.285523Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:35:38.203Z"}}], "cna": {"title": "Xagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Jack Taylor"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "xagio", "product": "Xagio SEO \u2013 AI Powered SEO", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.1.0.30"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-05T16:06:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72779dd2-04eb-445d-88a0-28a9c4d2369b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/inc/xagio_core.php#L236"}, {"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/modules/seo/models/xagio_tinymce.php#L91"}, {"url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/modules/seo/models/xagio_tinymce.php#L135"}, {"url": "https://plugins.trac.wordpress.org/changeset/3426300/xagio-seo#file374"}], "descriptions": [{"lang": "en", "value": "The Xagio SEO \u2013 AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixabayDownloadImage' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:45.483Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14438", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:00:45.483Z", "dateReserved": "2025-12-10T11:23:17.347Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-06T04:31:56.281Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Xagio SEO \u2013 AI Powered SEO", "vendor": "xagio", "versions": [{"lessThanOrEqual": "7.1.0.30", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Xagio SEO \u2013 AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixabayDownloadImage' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Xagio SEO \u2013 SEO impulsado por IA para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 7.1.0.30, inclusive, a trav\u00e9s de la funci\u00f3n 'pixabayDownloadImage'. Esto permite a atacantes autenticados, con acceso de nivel Suscriptor y superior, realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede ser utilizado para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-14438", "lastModified": "2026-06-17T08:35:55.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14438", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:35:32.285523Z", "version": "2.0.3"}}]}, "published": "2026-01-06T05:15:58.633", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/inc/xagio_core.php#L236"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/modules/seo/models/xagio_tinymce.php#L135"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.1.0.29/modules/seo/models/xagio_tinymce.php#L91"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3426300/xagio-seo#file374"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72779dd2-04eb-445d-88a0-28a9c4d2369b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:51:28.247695+00:00", "value": {"mitigation_remediation": ["Upgrade the Xagio SEO \u2013 AI Powered SEO plugin to version 7.1.0.31 or later, which removes the vulnerable pixabayDownloadImage function.", "If an immediate upgrade is not possible, severally limit the capabilities of Subscriber users to prevent execution of file\u2011download functionality, or remove the capability that allows invoking pixabayDownloadImage.", "Consider disabling or uninstalling the Xagio SEO plugin entirely if it is not essential to your site\u2019s functionality.", "Implement a Web Application Firewall rule that blocks outbound requests generated by the plugin\u2019s pixabayDownloadImage endpoint to prevent SSRF attempts."], "summary": {"action": "Patch Immediately", "impact": "Server\u2011Side Request Forgery enabling authenticated attackers to query or modify internal services"}, "threat_synthesis": {"affected_systems": "All installations of the Xagio SEO \u2013 AI Powered SEO plugin up to and including version 7.1.0.30 are affected. The plugin is distributed by xagio and installed within the WordPress ecosystem. Versions newer than 7.1.0.30 are presumed corrected.", "description_and_impact": "The vulnerability resides in the pixabayDownloadImage function of the Xagio SEO \u2013 AI Powered SEO WordPress plugin, allowing an authenticated user with Subscriber level privileges or higher to trigger outbound HTTP requests from the server. This Server\u2011Side Request Forgery can be used to retrieve sensitive information or alter data in internal systems, thereby compromising confidentiality and integrity. The flaw does not require elevated privileges beyond the defined role, so any logged\u2011in subscriber may exploit it.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The plugin is not listed in the CISA KEV catalog. The attack vector requires a legitimate WordPress login with at least Subscriber role, meaning that an attacker would first need access to a user account or must compromise authentication. Once authenticated, the attacker can invoke the vulnerable function to target arbitrary internal or external URLs, potentially causing information disclosure or modification."}}}}, "created": "2026-01-06T14:16:03.296588+00:00", "updated": "2026-04-21T17:00:12.319687+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "xagio", "xagio$PRODUCT$xagio_seo"]}