Restrict Content CVE-2025-14000

Requires an authenticated account with contributor-level capability or above on a WordPress site running Restrict Content ≤3.2.15, plus the use of the plugin's 'register_form' or 'restrict' shortcodes where attacker-supplied attributes are rendered. Exploitation is limited by that authentication requirement (not exploitable by anonymous visitors) and by the need for a victim to subsequently load the injected page for the script to fire; it does not depend on a non-default configuration beyond having the vulnerable plugin active and allowing contributor-level content creation.

Moderate, not urgent. The CVSS 3.1 score of 6.4 (vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects a stored XSS reachable over the network with low complexity, but it requires PR:L - authenticated contributor-level access or above - which is the single most important mitigating factor and the reason this sits in the medium band rather than critical. Exploitation signals are weak: EPSS is just 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit code was identified, so this is no public exploit identified at time of analysis. The scope-change flag (S:C) correctly captures that injected script executes in the browsers of other users (potentially higher-privileged admins), which is the real escalation risk. All signals are internally consistent - a low-privilege-gated, low-probability stored XSS - so there is no CVSS/EPSS/KEV conflict to flag. Bottom line: a legitimate issue to patch on a normal cycle, but it depends on an attacker first holding a contributor account on the target site, which bounds real-world risk to multi-author/membership sites with untrusted contributors.

A low-trust contributor account on a WordPress site running Restrict Content injects malicious attribute values into a page using the plugin's 'register_form' or 'restrict' shortcode. When an administrator or other user later views that page, the unsanitized script executes in their browser, enabling session/cookie theft or admin-action forgery. No public proof-of-concept exploit is known, and the low attack complexity (AC:L) means exploitation is straightforward once contributor access is obtained.