CVE-2025-14120 is a stored cross-site scripting vulnerability in the bww URL Image Importer WordPress plugin affecting all versions up to and including 1.0.7. The issue stems from inadequate sanitization of SVG files uploaded through the plugin, allowing authenticated users with Author-level access or higher to inject malicious scripts. These scripts execute in the context of any user viewing the SVG, potentially leading to script-based attacks such as session hijacking or defacement. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Author-level or higher privileges can exploit this vulnerability to inject and store malicious scripts within SVG files uploaded via the plugin. These scripts execute in the browsers of users who access the SVG files, potentially leading to unauthorized actions such as data theft or session compromise. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level and higher user permissions to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the plugin vendor or WordPress security advisories for an official patch or mitigation steps.