CVE-2025-14040 is a stored cross-site scripting vulnerability (CWE-79) in the Automotive Car Dealership Business WordPress Theme by themesuite. It arises from insufficient input sanitization and output escaping of user-supplied data in specific custom fields related to the 'Call to Action' feature. Authenticated users with contributor-level or higher permissions can inject arbitrary web scripts that execute in the context of other users viewing the injected pages. This vulnerability affects all versions up to 13.4 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to partial confidentiality and integrity loss (e.g., theft of cookies or session tokens, defacement, or unauthorized actions performed in the context of the victim user). Availability is not impacted. The vulnerability requires low attack complexity and no user interaction beyond visiting the injected page, but does require contributor-level privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only. Consider implementing additional input validation or output escaping at the application or web server level as a temporary mitigation. Monitor for suspicious activity related to injected scripts. Avoid exposing the affected custom fields to untrusted users.