CVE-2025-14554
Published: 31 January 2026
Summary
CVE-2025-14554 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-14554 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress. It affects all versions up to and including 1.5 and arises from insufficient input sanitization and output escaping in the 'orderform_data' AJAX action. The issue has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating high severity due to its network accessibility, low complexity, and lack of prerequisites.
Unauthenticated attackers can exploit the vulnerability by submitting malicious payloads via the 'orderform_data' AJAX action, injecting arbitrary web scripts into order records. These scripts execute in the context of the administrator's browser whenever they access the Orders page in the WordPress admin dashboard, potentially enabling session hijacking, data theft, or further site compromise.
The vulnerability was partially patched in version 1.5, as indicated in the CVE description. Relevant references include code locations at https://plugins.trac.wordpress.org/browser/sell-btc-by-hayyatapps/trunk/Pages/orders.php#L30, https://plugins.trac.wordpress.org/browser/sell-btc-by-hayyatapps/trunk/functions-admin.php#L39, and https://plugins.trac.wordpress.org/browser/sell-btc-by-hayyatapps/trunk/functions/form_tab.php#L12, along with WordPress plugin trac changesets https://plugins.trac.wordpress.org/changeset/3433480/ and https://plugins.trac.wordpress.org/changeset/3450361/, which document modifications addressing the issue. Security practitioners should verify full remediation beyond the partial fix and apply updates promptly.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206583
Vulnerability details
The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it…
more
possible for unauthenticated attackers to inject arbitrary web scripts in order records that will execute whenever an administrator accesses the Orders page in the admin dashboard. The vulnerability was partially patched in version 1.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing apps (T1190) and facilitates browser session hijacking via admin-context script execution (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the orderform_data AJAX handler, blocking unsanitized attacker payloads before they are stored in order records.
Mandates output filtering/escaping of order data on the admin Orders page, neutralizing stored scripts before they execute in the administrator's browser.
Provides malicious-code inspection and blocking mechanisms that can detect or prevent execution of injected scripts in the WordPress admin context.