CVE-2025-14893

MEDIUM

IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-14893 has a selected CVSS score of 6.4 (medium); EIP currently links 1 repository PoC.

Description

The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 9, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

IndieWeb

Browse indieweb / IndieWeb

Default status: unaffected

CVE ListThrough 4.0.5affected

Proofs of concept

1

Repository PoCs

GitHubd3kc4rt1/CVE-2025-14893Repository PoCby d3kc4rt10Writeup1 file

4.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a stored XSS vulnerability (CVE-2025-14893) in the IndieWeb WordPress plugin. It includes a root cause analysis, a vulnerable code snippet, and manual exploitation steps, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a known Stored XSS vulnerability (CVE-2025-14893) in the IndieWeb WordPress plugin. It contains a description, root cause analysis, a proof-of-concept payload, and remediation advice. No concealed executable behavior, backdoor, or deceptive payload targeting the person running the PoC is present.

ClassificationWriteup
Model confidence100%
AuthenticationRequired
LanguagesMarkdownPHPHTTP
Target softwareIndieWeb WordPress Plugin
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a technical analysis, root cause explanation, and manual exploitation steps for CVE-2025-14893. It does not contain any executable code, scripts, or automated tools that would classify it as an exploit or scanner. It is a substantive technical writeup.

README.md:1-79

Requirements

  • WordPress installed with IndieWeb <= 4.0.5 activated.README.md:36
  • An attacker account with the Author role.README.md:37
  • The 'Author Profile H-Card Widget' added to a visible frontend area.README.md:38

Observed behavior

  • Describes injecting a crafted payload into the Telephone profile field to break out of an href attribute and inject an onclick event handler.README.md:44-47
  • Describes that the injected script executes when an Administrator visits a post page and clicks the manipulated link.README.md:50
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Documentation
CVE-2025-14893 Stored XSS in IndieWeb WordPress pluginThe README describes a legitimate vulnerability with a standard PoC payload that exploits the target plugin, not the reviewer.README.md:1-79
Review boundaries

What the analysis did not establish

  • The evidence packet contains only a single README.md file; no other source code, scripts, or configuration files from the repository are included.
  • The analysis_scope reports complete_artifact_coverage as false, indicating that not all files from the repository snapshot are present in the evidence.
  • Only the README.md file was provided; no other repository files were inspected.
  • Binary files were flagged as metadata-only and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3