What is the CVSS score of CVE-2025-14032?

CVE-2025-14032 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-14032

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-12 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Bold Timeline Lite WordPress plugin up to version 1.2.7 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the 'title' parameter of the 'bold_timeline_group' shortcode, executing malicious scripts whenever users view affected pages. CVSS 6.4 reflects moderate impact (confidentiality and integrity compromise across trust boundaries); EPSS 0.04% indicates low real-world exploitation probability. No public exploit code or active exploitation confirmed.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient input sanitization and output escaping in the bold_timeline_group shortcode handler. The vulnerable code in bold_timeline_group_view.php line 79 processes the 'title' parameter without proper sanitization before rendering it into HTML context. WordPress plugins using shortcodes must sanitize all user inputs (via functions like sanitize_text_field) and escape output appropriate to context (esc_html, esc_attr, wp_kses_post). The attack surface is limited to authenticated users with Contributor or higher capabilities, reducing exposure compared to unauthenticated XSS. The stored nature means injected payloads persist and execute for all site visitors viewing the affected page.

Affected ProductsAI

Bold Timeline Lite WordPress plugin versions 1.2.7 and all prior versions are vulnerable. The plugin is distributed via the official WordPress plugin repository (wordpress.org/plugins/bold-timeline-lite). Wordfence has assigned identifier 840fd950-3ce3-4068-b8bc-270f168a5091 to track this issue. CPE for this plugin would be cpe:2.3:a:bold_timeline_lite_project:bold_timeline_lite:*:*:*:*:*:wordpress:*:* with version up_to_and_including 1.2.7.

RemediationAI

Update Bold Timeline Lite to version 1.2.8 or later, which includes fixes for input sanitization and output escaping of the 'title' parameter. Site administrators should navigate to Plugins > Installed Plugins, find Bold Timeline Lite, and click Update if available. For sites unable to update immediately, review user access: restrict Contributor and Editor roles to trusted users only, and audit existing timeline group shortcodes for suspicious 'title' parameter content using the plugin settings or raw page/post content editor. Wordfence provides detailed vulnerability information at https://www.wordfence.com/threat-intel/vulnerabilities/id/840fd950-3ce3-4068-b8bc-270f168a5091?source=cve and WordPress.org plugin repository serves as the authoritative source for patch availability.