CVE-2025-14076 is a reflected cross-site scripting vulnerability in the iXML – Google XML sitemap generator WordPress plugin affecting all versions up to 0.6. The vulnerability is due to improper neutralization of input in the 'iXML_email' parameter, allowing injection of malicious scripts that execute when a user interacts with a crafted URL. The vulnerability requires no privileges but does require user interaction. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No known exploits in the wild or patches have been reported.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a crafted link. This can lead to information disclosure or manipulation of user interactions within the affected site. The vulnerability does not impact system availability. The medium CVSS score reflects moderate risk due to the need for user interaction and limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin. Additionally, applying web application firewall (WAF) rules that detect and block malicious input targeting the 'iXML_email' parameter may help mitigate exploitation risk. Users should also exercise caution with unsolicited links that may exploit this vulnerability.