SQL Injection Vulnerability in Design Import/Export Plugin for WordPress
CVE-2025-14050
4.9MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 December 2025
What is CVE-2025-14050?
The Design Import/Export plugin for WordPress suffers from a SQL Injection vulnerability due to inadequate escaping of user-supplied parameters in XML file imports. This flaw affects all versions up to and including 2.2. Authenticated attackers with administrator privileges can manipulate existing SQL queries, potentially allowing them to extract sensitive information from the database. Ensuring proper input sanitization and strengthening query preparations are critical to mitigate this risk.
Affected Version(s)
Design Import/Export – Styles, Templates, Template Parts and Patterns * <= 2.2