How to fix CVE-2025-14554?

Within 24 hours: Audit all WordPress installations to identify deployments of the Sell BTC plugin and document affected environments. Within 7 days: Implement Web Application Firewall (WAF) rules to block XSS payloads targeting the plugin's input vectors, and consider disabling the plugin if business-critical functionality allows. Within 30 days: Monitor vendor security advisories for patch availability; evaluate alternative cryptocurrency calculator plugins or develop custom replacement functionality to eliminate dependency on the vulnerable plugin.

Is PHP affected by CVE-2025-14554?

The Sell BTC cryptocurrency calculator WordPress plugin contains a cross-site scripting vulnerability that could allow attackers to inject malicious code and compromise website visitors' data or sessions.

CVE-2025-14554

HIGH

2026-01-31 [email protected]

7.2

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 31, 2026 - 14:16 nvd

HIGH 7.2

Description

The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in order records that will execute whenever an administrator accesses the Orders page in the admin dashboard. The vulnerability was partially patched in version 1.5.

Analysis

Sell BTC - Cryptocurrency Selling Calculator (WordPress plugin) is affected by cross-site scripting (xss) (CVSS 7.2).

Technical Context

This vulnerability (CWE-79: Cross-site Scripting (XSS)) affects Sell BTC - Cryptocurrency Selling Calculator (WordPress plugin). The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in order records that will execute whenever an administrator accesses the Orders page in the admin dashboard. The vulnerability was partially patched in version

Affected Products

Vendor: WordPress. Product: Sell BTC - Cryptocurrency Selling Calculator (WordPress plugin).

Remediation

Fixed in version 1.5.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +36

POC: 0

CVE-2025-14554 vulnerability details – vuln.today

Back

CVE-2025-14554

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-14554

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code