{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14076", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-04T22:21:32.600Z", "datePublished": "2026-02-19T04:36:16.830Z", "dateUpdated": "2026-04-08T17:02:41.196Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:41.196Z"}, "affected": [{"vendor": "icount", "product": "iXML \u2013 Google XML sitemap generator", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The iXML \u2013 Google XML sitemap generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'iXML_email' parameter in all versions up to, and including, 0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "iXML \u2013 Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c63bb98-5bfb-471f-a612-cc7634cd6dc5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ixml/trunk/iXML.php#L249"}, {"url": "https://plugins.trac.wordpress.org/browser/ixml/tags/0.6/iXML.php#L249"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "timeline": [{"time": "2026-02-18T15:56:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T20:38:02.629716Z", "id": "CVE-2025-14076", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T20:38:20.577Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14076", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T20:38:02.629716Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T20:38:07.676Z"}}], "cna": {"title": "iXML \u2013 Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "JohSka"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "icount", "product": "iXML \u2013 Google XML sitemap generator", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T15:56:28.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c63bb98-5bfb-471f-a612-cc7634cd6dc5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ixml/trunk/iXML.php#L249"}, {"url": "https://plugins.trac.wordpress.org/browser/ixml/tags/0.6/iXML.php#L249"}], "descriptions": [{"lang": "en", "value": "The iXML \u2013 Google XML sitemap generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'iXML_email' parameter in all versions up to, and including, 0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:41.196Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14076", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:41.196Z", "dateReserved": "2025-12-04T22:21:32.600Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:16.830Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The iXML \u2013 Google XML sitemap generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'iXML_email' parameter in all versions up to, and including, 0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin iXML \u2013 generador de sitemaps XML de Google para WordPress es vulnerable a cross-site scripting reflejado a trav\u00e9s del par\u00e1metro 'iXML_email' en todas las versiones hasta la 0.6, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-14076", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-02-19T07:17:34.187", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ixml/tags/0.6/iXML.php#L249"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ixml/trunk/iXML.php#L249"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c63bb98-5bfb-471f-a612-cc7634cd6dc5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "iXML \u2013 Google XML sitemap generator", "source": "cna", "vendor": "icount"}, "product": "ixml_\u2013_google_xml_sitemap_generator", "vendor": "icount"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T15:53:19.401310+00:00", "value": {"mitigation_remediation": ["Upgrade the iXML plugin to the latest release, which sanitizes and escapes the iXML_email parameter; if no newer release exists, remove the plugin entirely.", "If upgrading is not possible, patch the plugin\u2019s iXML.php file: apply WordPress sanitization such as sanitize_text_field() to the parameter before any output and wrap its usage with esc_html() or esc_js() to ensure proper escaping.", "Implement a site\u2011wide content\u2011security\u2011policy that disallows inline script execution and restricts script sources, thereby mitigating any accidental execution of injected code if an unpatched instance remains in use."], "summary": {"action": "Patch", "impact": "Reflected Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have the iXML \u2013 Google XML sitemap generator plugin installed in version\u00a00.6 or earlier are affected. The flaw resides in the iXML.php file, where the iXML_email parameter is directly output without validation.", "description_and_impact": "The iXML \u2013 Google XML sitemap generator plugin is vulnerable to reflected XSS because the iXML_email URL parameter is not properly sanitized or escaped. An unauthenticated attacker can embed malicious scripts in a crafted link; when a user follows the link the plugin renders the parameter value, causing the browser to execute the attacker\u2019s code. This can lead to session cookie theft, credential phishing, site defacement or the initiation of further malicious activity in the victim\u2019s session.", "risk_and_exploitability": "The CVSS base score of\u00a06.1 indicates medium severity, while the EPSS score of less than\u00a01\u202f% shows a very low current exploitation probability. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers only need to craft a malicious URL and convince a user to click it\u2014no authentication or special configuration is required\u2014so the risk is moderate but off\u2011the\u2011wall exploitation remains unlikely at present."}}}}, "created": "2026-02-19T10:07:06.810272+00:00", "updated": "2026-04-21T16:00:13.274261+00:00", "vendors": ["icount", "icount$PRODUCT$ixml_\u2013_google_xml_sitemap_generator", "wordpress", "wordpress$PRODUCT$wordpress"]}