CVE-2025-14050 is an SQL Injection vulnerability in the uxl Design Import/Export plugin for WordPress, affecting all versions up to 2.2. The issue arises from insufficient escaping of user-supplied parameters during XML file import and inadequate preparation of SQL queries. Authenticated users with administrator privileges can append malicious SQL commands to existing queries, potentially exposing sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 4.9, reflecting medium severity with network attack vector, low attack complexity, and high privileges required.

An attacker with administrator-level access can exploit this vulnerability to execute unauthorized SQL queries, leading to the disclosure of sensitive information stored in the database. The integrity and availability of the database are not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and avoid importing XML files from untrusted sources. Monitor for updates from the plugin vendor regarding patches or official mitigations.