CVE-2025-14032 is a stored cross-site scripting vulnerability in the Bold Timeline Lite WordPress plugin affecting all versions up to 1.2.7. The flaw exists due to improper neutralization of input in the 'title' parameter of the 'bold_timeline_group' shortcode, allowing authenticated users with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting its medium severity and the requirement for authenticated privileges to exploit.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode parameter. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no direct impact on availability. The vulnerability requires authentication and has a low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Bold Timeline Lite plugin if feasible. Monitor for plugin updates from boldthemes addressing this vulnerability.