CVE-2025-1407 is a stored cross-site scripting vulnerability in the AMO Team Showcase WordPress plugin (up to version 1.1.4). The issue stems from improper neutralization of input in the amoteam_skills shortcode, where user-supplied attributes are not adequately sanitized or escaped. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (C:L/I:L/A:N).

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users viewing the infected pages, potentially leading to theft of sensitive information or manipulation of page content. The impact is limited to confidentiality and integrity with no availability impact, consistent with the CVSS score of 6.4 (medium severity). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restricting contributor-level access and above to trusted users only can reduce risk. Avoid using the vulnerable shortcode with untrusted input. Implementing additional input sanitization or output escaping via custom code or security plugins may provide temporary mitigation.