CVE-2025-14313

MediumCVSS 6.1

Published: 30/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Advance WP Query Search Filter WordPress plugin through version 1.0.10 does not sanitize and escape a parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting. This can be exploited against high-privilege users such as administrators.

Risk Assessment

An attacker can execute malicious scripts in the admin's browser, potentially leading to session hijacking, data theft, or site modification.

Recommendation

Update the plugin to the latest version if available, or remove it if unsupported. Additionally, apply Web Application Firewall (WAF) protections and filter input parameters.

Other vulnerabilities in Advance WP Query Search Filter

CVE-2025-14312Medium
The Advance WP Query Search Filter WordPress plugin through version 1.0.10 does not sanitize and escape a parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting. This can be exploited against high-privilege users such as administrators.

Original NVD description (English source)

The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Vulnerability data from NVD (NIST) · CISA KEV · EPSS