CVE-2025-14053 is a stored cross-site scripting vulnerability in the jseto Travel Bucket List – Wish To Go WordPress plugin. The flaw exists in all versions up to and including 0.5.2, where shortcode attributes are not properly sanitized or escaped before being rendered on pages. This allows authenticated attackers with Contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of other users viewing the compromised pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability impacts confidentiality and integrity but not availability.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who visit the injected pages, potentially leading to theft of session tokens, user impersonation, or other unauthorized actions within the affected site context. The vulnerability does not affect availability and requires authenticated access, limiting exposure somewhat.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor-level access to trusted users only and consider removing or disabling the Wish To Go plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.