CVE-2025-14124

High · 8.6

CVSS

8.6

EPSS

1.7%

Published

Jan 5, 2026

CISA due date

—

The record

The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected packages

Ecosystem	Package	Introduced	Fixed