CVE-2025-14110 – The WP Js List Pages Shortcodes WordPress plugi... (How to Fix)

Q: What is the severity of CVE-2025-14110?

CVE-2025-14110 has a CVSS score of 6.4 (MEDIUM). The WP Js List Pages Shortcodes WordPress plugin has a stored XSS vulnerability in all versions up to 1.21. Authenticated attackers with Contributor access or higher can inject malicious scripts via the 'class' shortcode attribute, which execute when users view affected pages. This affects all WordPress sites using vulnerable versions of this plugin.

📋 TL;DR

The WP Js List Pages Shortcodes WordPress plugin has a stored XSS vulnerability in all versions up to 1.21. Authenticated attackers with Contributor access or higher can inject malicious scripts via the 'class' shortcode attribute, which execute when users view affected pages. This affects all WordPress sites using vulnerable versions of this plugin.

💻 Affected Systems

Products:

WP Js List Pages Shortcodes WordPress plugin

Versions: All versions up to and including 1.21

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated attacker with at least Contributor role. WordPress multisite installations are also affected.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal admin credentials, redirect users to malicious sites, deface websites, or install backdoors for persistent access.

🟠

Likely Case

Attackers with contributor accounts inject malicious scripts to steal user session cookies or redirect visitors to phishing pages.

🟢

If Mitigated

With proper user access controls and content security policies, impact is limited to potential data leakage from affected pages.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires Contributor-level access. The vulnerability is straightforward to exploit once authenticated.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version after 1.21 (check WordPress plugin repository)

Vendor Advisory: https://plugins.trac.wordpress.org/browser/wp-js-list-pages-shortcodes

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'WP Js List Pages Shortcodes'. 4. Click 'Update Now' if available. 5. If no update available, deactivate and delete the plugin.

🔧 Temporary Workarounds

Remove Contributor Role Access

all

Temporarily restrict or remove Contributor role access until patching is complete.

Use WordPress user management to modify role permissions

Content Security Policy

all

Implement CSP headers to restrict script execution from untrusted sources.

Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or use WordPress security plugins to implement CSP

🧯 If You Can't Patch

Deactivate and remove the WP Js List Pages Shortcodes plugin immediately
Implement strict user access controls and audit all Contributor-level accounts

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'WP Js List Pages Shortcodes' version 1.21 or earlier

Check Version:

WordPress CLI: wp plugin list --name='wp-js-list-pages-shortcodes' --field=version

Verify Fix Applied:

Verify plugin version is higher than 1.21 or plugin is completely removed

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to wp-admin with 'class' parameter containing script tags
Multiple page edits by Contributor accounts in short timeframe

Network Indicators:

Outbound connections to suspicious domains from WordPress pages
Unexpected script loads in page responses

SIEM Query:

source="wordpress" AND (http_method="POST" AND uri_path="/wp-admin/*" AND http_query="*class=*script*" OR http_body="*class=*script*")

📊 Metadata

CVE ID: CVE-2025-14110

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.04% exploit probability (12.5th percentile)

Published: January 7, 2026

Last Updated: January 8, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-14110, you might also want to check these: