Cyber Resilience

CVE-2025-14316

High

Published: 26 January 2026

Published
26 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0002 5.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14316 is a high-severity an unspecified weakness vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-14316 is a reflected cross-site scripting (XSS) vulnerability in the AhaChat Messenger Marketing WordPress plugin through version 1.1. The flaw arises because the plugin fails to sanitize and escape a parameter before outputting it back in the page, allowing malicious scripts to be injected and executed in a user's browser.

The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low complexity, no required privileges, and user interaction. An unauthenticated attacker can craft a malicious link or payload that, when clicked by a high-privilege user such as an administrator, executes arbitrary JavaScript in the victim's browser context. This could enable session hijacking, theft of sensitive data, or further compromise of the WordPress site.

The WPScan advisory at https://wpscan.com/vulnerability/7d69ebec-f940-4491-a51e-70a9e1bf8a4c/ provides additional details on the issue.

EU & UK References

Vulnerability details

The AhaChat Messenger Marketing WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CWE(s)
None listed

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
attack.mitre.org →
Why these techniques?

Reflected XSS in public-facing WordPress plugin directly matches T1190 exploitation; enables browser session hijacking (T1185) and malicious link delivery (T1566.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of untrusted input parameters before they are processed or reflected in responses, blocking the unsanitized parameter that enables this reflected XSS.

SI-15 Information Output Filtering good match
prevent

Requires filtering or encoding of information outputs to prevent injection of malicious scripts, directly mitigating the failure to escape the parameter before page rendering.

SC-18 Mobile Code partial match
prevent

Restricts execution of mobile code (e.g., scripts) received from external sources, limiting the impact of reflected XSS payloads delivered via crafted links to administrators.

References