CVE-2025-14941: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in aminhashemy GZSEO
The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11. This is due to missing capability checks on multiple AJAX handlers combined with insufficient input sanitization and output escaping on the embed_code parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary content into any post on the site that will execute whenever a user accesses an injected page.
AI Analysis
Technical Summary
CVE-2025-14941 is a stored cross-site scripting vulnerability in the aminhashemy GZSEO WordPress plugin versions up to 2.0.11. The issue arises from missing capability checks on several AJAX handlers combined with inadequate input sanitization and output escaping of the embed_code parameter. Authenticated attackers with contributor or higher privileges can inject malicious scripts into posts, which execute in the context of users viewing those posts. This vulnerability impacts the integrity and confidentiality of user sessions and data on affected sites.
Potential Impact
Successful exploitation allows authenticated users with contributor-level access or above to inject and execute arbitrary scripts within posts. This can lead to session hijacking, defacement, or other client-side attacks impacting users who visit the compromised pages. The vulnerability does not affect availability and requires at least low privileges to exploit.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access and above to trusted users only. Consider disabling or removing the GZSEO plugin if possible to prevent exploitation.
CVE-2025-14941: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in aminhashemy GZSEO
Description
The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11. This is due to missing capability checks on multiple AJAX handlers combined with insufficient input sanitization and output escaping on the embed_code parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary content into any post on the site that will execute whenever a user accesses an injected page.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-14941 is a stored cross-site scripting vulnerability in the aminhashemy GZSEO WordPress plugin versions up to 2.0.11. The issue arises from missing capability checks on several AJAX handlers combined with inadequate input sanitization and output escaping of the embed_code parameter. Authenticated attackers with contributor or higher privileges can inject malicious scripts into posts, which execute in the context of users viewing those posts. This vulnerability impacts the integrity and confidentiality of user sessions and data on affected sites.
Potential Impact
Successful exploitation allows authenticated users with contributor-level access or above to inject and execute arbitrary scripts within posts. This can lead to session hijacking, defacement, or other client-side attacks impacting users who visit the compromised pages. The vulnerability does not affect availability and requires at least low privileges to exploit.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access and above to trusted users only. Consider disabling or removing the GZSEO plugin if possible to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-12-18T22:14:18.821Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6974765d4623b1157ca738fd
Added to database: 1/24/2026, 7:35:57 AM
Last enriched: 4/9/2026, 9:54:31 AM
Last updated: 5/10/2026, 9:24:33 AM
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.