Security Alert Summary
The ConvertForce Popup Builder plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg block’s entrance_animation attribute. Insufficient input sanitization and output escaping allow authenticated users with Author-level access or higher to inject scripts that execute when an injected page is viewed.
CVE Details
- CVE ID: CVE-2025-14506
- Affected plugin / component: ConvertForce Popup Builder plugin for WordPress
- Affected versions: All versions up to, and including, 0.0.7
- Published: January 10, 2026 at 12:15:48 PM UTC
- Last modified: January 10, 2026 at 12:15:48 PM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low (authenticated user with author-level privileges or higher)
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
- CWE / weakness: CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored Cross-Site Scripting (XSS) issue caused by insufficient input sanitization and output escaping of the Gutenberg block attribute entrance_animation. When the plugin stores user-supplied content for this attribute without proper sanitization and later outputs it into a page, an authenticated user with author-level access or higher can supply payloads that are persisted and executed in the context of visitors viewing the affected page.
The CVE references the plugin’s block implementation (Conversion.php) where the attribute is processed; the lack of escaping/sanitization around the entrance_animation attribute handling is the root cause. Because the malicious content is stored, the script executes whenever the injected page is loaded by other users or administrators.
Impact is limited to what stored XSS typically enables: execution of attacker-controlled JavaScript in the context of the site and the affected user’s browser. This can lead to session token exposure, unauthorized actions performed in the context of the victim’s session, or disclosure of data visible to the victim, consistent with the CVSS confidentiality and integrity impacts being rated as Low. The CVE does not specify any other vulnerable functions or REST API endpoints beyond the Gutenberg block attribute.
How This Could Impact Your Website
Consider a small team managing a WordPress site: the site owner, an internal content editor, and an external contractor who has author-level access to create or edit content. If the contractor or an editor inserts a malicious payload into the Gutenberg block’s entrance_animation attribute, that payload would be stored in the site content. When other users—including administrators or site visitors who view the page—open the page, the injected script can execute in their browsers.
Practical consequences include limited disclosure of information accessible in a user’s browser (for example, tokens or data visible to that user) and the possibility of unauthorized actions performed in the context of a logged-in user. There is also an increased risk of targeted phishing or social engineering if attacker-controlled scripts can read or expose internal user information. The CVSS ratings indicate confidentiality and integrity impacts are Low and availability is not impacted; full site compromise is not indicated by the CVE data alone.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (CVE data specifies affected versions up to 0.0.7.)
- Review and reduce unnecessary user roles and privileges, especially users with Author-level access or higher.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected content changes or posts edited by unfamiliar accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/convertforce-popup-builder/trunk/inc/Blocks/Conversion.php#L47
- https://plugins.trac.wordpress.org/browser/convertforce-popup-builder/trunk/inc/Blocks/Conversion.php#L66
- https://plugins.trac.wordpress.org/changeset/3419678/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c57b9a78-53f4-40bb-ae6a-c5242b41329f?source=cve
