CVE-2025-14132 is a reflected cross-site scripting vulnerability in the Category Dropdown List plugin for WordPress, affecting all versions up to 1.0. The vulnerability arises from improper neutralization of input in the $_SERVER['PHP_SELF'] variable, allowing attackers to inject malicious scripts into web pages. Exploitation requires user interaction (clicking a crafted link) and can lead to partial confidentiality and integrity impact without affecting availability. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity). No patch or official fix has been documented in the provided data.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials or perform actions on behalf of authenticated users. The impact is limited to confidentiality and integrity with no direct availability impact. Since the vulnerability is reflected XSS, exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the vulnerable plugin or applying manual input sanitization and output escaping if feasible. Monitor official sources for updates or patches from the plugin author.