CVE-2025-14114 is a stored cross-site scripting vulnerability in the 1180px Shortcodes WordPress plugin by chrisblackwell. The flaw exists in all versions up to and including 1.1.1, where the 'class' shortcode attribute is not properly sanitized or escaped. This allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code into pages. When other users access these pages, the injected scripts execute, potentially leading to session hijacking or other client-side attacks. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into WordPress pages. These scripts execute in the context of users viewing the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability does not impact availability and requires authenticated access, limiting the attack surface to users with some level of trust in the WordPress environment.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict Contributor-level access to trusted users only and consider disabling or removing the 1180px Shortcodes plugin until a fix is released. Employing a Web Application Firewall (WAF) with XSS filtering may help reduce risk but is not a complete solution.