CVE-2025-14280

PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log File

2025-12-29 05:47
Marcin Dudek (dudekmar)

Strategic Overview

Status
Patched in 11.1.5.1
Affected Plugin
PixelYourSite – Your smart PIXEL (TAG) & API Manager
Affected Version
<= 11.1.5
CVSS
5.3Medium
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE-2025-14280
View all PixelYourSite – Your smart PIXEL (TAG) & API Manager vulnerabilities

At a glance

CVE-2025-14280 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the PixelYourSite WordPress plugin, affecting versions <= 11.1.5. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 11.1.5.1; sites on affected versions should update now. Disclosed December 2025, reported by Marcin Dudek (dudekmar).

Vulnerability Overview

The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, when the "Meta API logs" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully patched in version 11.1.5.1.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Reaching this weakness in PixelYourSite <= 11.1.5 takes a caller who can reach the endpoint. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For PixelYourSite the fix is 11.1.5.1: builds <= 11.1.5 are affected, anything from 11.1.5.1 onward is not.

Remediation

Update to version 11.1.5.1, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: PixelYourSite 11.1.5.1 closes this, and updating the plugin is the step that ends it.

  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2025-14280https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe77926-8a43-42ce-9d3d-3aac2334dcbdhttps://nvd.nist.gov/vuln/detail/CVE-2025-14280

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C