CVE-2025-14118 is a reflected cross-site scripting vulnerability in the callumalden Starred Review WordPress plugin, affecting all versions up to 1.4.2. The issue stems from improper neutralization of input during web page generation, specifically via the PHP_SELF variable. This allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted URL. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting a medium severity level with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity but not availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or manipulation of web content. The vulnerability does not affect system availability. Since exploitation requires user interaction (clicking a crafted link), the risk is moderated but still significant for targeted phishing or social engineering attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Starred Review plugin if feasible. Additionally, applying web application firewall (WAF) rules that detect and block reflected XSS attempts targeting the PHP_SELF variable may provide temporary mitigation.