CVE-2025-14792 audrasjb CVE debrief

Who should care

WordPress administrators and security teams, especially those with multi-site installations or unfiltered_html disabled, should assess exposure and verify administrator-level access controls.

Why it matters

CVE-2025-14792 allows authenticated attackers with administrator-level access to inject arbitrary web scripts in WordPress multi-site installations or installations with unfiltered_html disabled, enabling Stored Cross-Site Scripting attacks.

• Authenticated attackers with administrator-level access can inject arbitrary web scripts
• Injected scripts execute when a user accesses an injected page
• This vulnerability only affects multi-site installations and installations where unfiltered_html has been disabled

Technical summary

The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_render function in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability affects multi-site installations and installations where unfiltered_html has been disabled, allowing for potential code execution.

Defensive priority

Assess exposure in WordPress multi-site installations and installations with unfiltered_html disabled; verify administrator-level access controls.

Recommended defensive actions

• Assess exposure in WordPress multi-site installations and installations with unfiltered_html disabled
• Verify administrator-level access controls
• Review and update the Key Figures plugin to a version beyond 1.1 if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, but do not specify versions beyond 1.1 or provide additional details on exploitation. The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_render function in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This vulnerability affects multi-site installations and installations where unfiltered_html has been disabled. Defenders should  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.