d3kc4rt1/CVE-2025-14893

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a stored XSS vulnerability (CVE-2025-14893) in the IndieWeb WordPress plugin. It includes a root cause analysis, a vulnerable code snippet, and manual exploitation steps, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a known Stored XSS vulnerability (CVE-2025-14893) in the IndieWeb WordPress plugin. It contains a description, root cause analysis, a proof-of-concept payload, and remediation advice. No concealed executable behavior, backdoor, or deceptive payload targeting the person running the PoC is present.

ClassificationWriteup
Model confidence100%
AuthenticationRequired
LanguagesMarkdownPHPHTTP
Target softwareIndieWeb WordPress Plugin
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a technical analysis, root cause explanation, and manual exploitation steps for CVE-2025-14893. It does not contain any executable code, scripts, or automated tools that would classify it as an exploit or scanner. It is a substantive technical writeup.

README.md:1-79

Requirements

  • WordPress installed with IndieWeb <= 4.0.5 activated.README.md:36
  • An attacker account with the Author role.README.md:37
  • The 'Author Profile H-Card Widget' added to a visible frontend area.README.md:38

Observed behavior

  • Describes injecting a crafted payload into the Telephone profile field to break out of an href attribute and inject an onclick event handler.README.md:44-47
  • Describes that the injected script executes when an Administrator visits a post page and clicks the manipulated link.README.md:50
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Documentation
CVE-2025-14893 Stored XSS in IndieWeb WordPress pluginThe README describes a legitimate vulnerability with a standard PoC payload that exploits the target plugin, not the reviewer.README.md:1-79
Review boundaries

What the analysis did not establish

  • The evidence packet contains only a single README.md file; no other source code, scripts, or configuration files from the repository are included.
  • The analysis_scope reports complete_artifact_coverage as false, indicating that not all files from the repository snapshot are present in the evidence.
  • Only the README.md file was provided; no other repository files were inspected.
  • Binary files were flagged as metadata-only and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1