Atomic Edge analysis of CVE-2025-14797:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Same Category Posts WordPress plugin. The plugin’s widget title placeholder functionality fails to properly sanitize taxonomy term names before output. Attackers with Author-level access or higher can inject malicious scripts that execute when a user views a page containing the compromised widget.

The root cause is the use of the `htmlspecialchars_decode()` function on widget title output in the `same-category-posts.php` file. WordPress core intentionally encodes HTML entities in taxonomy term names for safety. The plugin’s code, specifically in lines 636, 662, and 704, decodes these entities before echoing them, effectively reversing the security encoding. This occurs within the `widget()` and `shortcode()` methods of the plugin’s widget class.

Exploitation requires an authenticated attacker with at least Author privileges. The attacker would create or edit a post, assign it to a specially crafted category or tag name containing a JavaScript payload (e.g., `alert(document.domain)`). They would then configure the Same Category Posts widget to use that taxonomy term as a title placeholder. When the widget renders on a front-end page, the `htmlspecialchars_decode()` call decodes the stored HTML entities, causing the script to execute in visitors’ browsers.

The patch replaces `htmlspecialchars_decode()` with `wp_kses_post()` in the three affected output lines. The `wp_kses_post()` function is a WordPress security function that sanitizes content for allowed HTML tags and attributes in post content. This change ensures any HTML entities in the taxonomy term name remain safely encoded, or any allowed HTML is properly sanitized, neutralizing the XSS payload.

Successful exploitation allows an attacker to inject arbitrary JavaScript that executes in the context of any user viewing a page with the malicious widget. This can lead to session hijacking, actions performed on behalf of the user, defacement, or redirection to malicious sites. The requirement for Author-level access limits the attack surface but poses a significant risk in multi-author environments.