CVE-2025-14035 is a stored cross-site scripting vulnerability in the DebateMaster WordPress plugin (versions up to 1.0.0). The flaw exists due to improper neutralization of input in the color options within the plugin settings, allowing authenticated administrators to inject malicious scripts. These scripts execute in the context of users viewing pages containing the debate shortcode. The vulnerability impacts multi-site WordPress installations or those with unfiltered_html disabled, requiring high privileges to exploit. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with Administrator-level access can inject persistent malicious scripts into pages using the debate shortcode. This can lead to partial confidentiality and integrity compromise for users viewing those pages. The vulnerability does not affect availability. Because exploitation requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled), the attack surface is limited. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, administrators should monitor for updates from the plugin author or WordPress security advisories. As a temporary mitigation, restrict Administrator-level access to trusted users only and consider disabling or removing the DebateMaster plugin if multi-site or unfiltered_html configurations are in use. Review plugin settings for suspicious entries in color options and sanitize inputs manually if possible.