Reflected Cross-Site Scripting in Simple AL Slider Plugin by WordPress

CVE-2025-14137

What is CVE-2025-14137?

The Simple AL Slider plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping of the $_SERVER['PHP_SELF'] variable. This vulnerability allows unauthenticated attackers to inject malicious web scripts, potentially affecting users who are misled into interacting with crafted links. As a result, the security and integrity of user sessions may be compromised if an attacker successfully exploits this weakness.

References