CVE-2025-14128 is a reflected cross-site scripting vulnerability in the Stumble! for WordPress plugin caused by improper neutralization of input during web page generation. Specifically, the plugin fails to properly sanitize and escape the $_SERVER['PHP_SELF'] variable, enabling attackers to inject malicious scripts. This vulnerability affects all versions up to and including 1.1.1. Exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser context.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or conduct other malicious activities limited to the scope of the reflected XSS. The vulnerability does not require authentication but does require user interaction (clicking a link). There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or applying manual input sanitization and output escaping as a temporary mitigation. Avoid clicking on suspicious links that may exploit this vulnerability.