CVE-2025-13614 is a stored cross-site scripting vulnerability in the Cool Tag Cloud WordPress plugin (versions up to and including 2.29). It results from improper neutralization of input during web page generation, specifically in the 'cool_tag_cloud' shortcode. Authenticated users with contributor or higher privileges can inject arbitrary scripts due to insufficient input sanitization and output escaping of user-supplied attributes. This vulnerability can lead to execution of malicious scripts in the context of users visiting the compromised pages. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to theft of sensitive information such as cookies or session tokens, unauthorized actions performed on behalf of users, and potential compromise of user accounts. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Cool Tag Cloud plugin if possible. Monitor official wpkube communications for updates regarding patches or mitigations.