Reflected Cross-Site Scripting in WP Widget Changer Plugin by WordPress

CVE-2025-14131

What is CVE-2025-14131?

The WP Widget Changer plugin for WordPress is exposed to a reflected cross-site scripting vulnerability. This issue stems from the inadequate sanitization of user input, specifically the $_SERVER['PHP_SELF'] variable, allowing attackers to craft malicious scripts. If an attacker successfully deceives a user into clicking a tainted link, arbitrary web scripts can execute within the user’s browser session, potentially compromising sensitive data or user actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References