CVE-2025-14129 is a reflected cross-site scripting vulnerability in the Like DisLike Voting plugin for WordPress, affecting all versions up to 1.0.1. The vulnerability stems from improper neutralization of input during web page generation, specifically via the $_SERVER['PHP_SELF'] variable. This allows attackers to inject malicious scripts that execute in the context of the victim's browser if they are tricked into clicking a crafted link. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in information disclosure or manipulation of user interactions within the affected site. The vulnerability does not impact system availability and requires user interaction to trigger. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Like DisLike Voting plugin or applying manual input sanitization and output escaping measures if feasible. Avoid clicking on suspicious links that could exploit this vulnerability.