CVE-2025-14137 is a reflected cross-site scripting vulnerability in the Simple AL Slider WordPress plugin (versions up to 1.2.10). The issue arises from improper neutralization of input in the $_SERVER['PHP_SELF'] variable, which is used in web page generation without adequate sanitization or escaping. This allows unauthenticated attackers to craft URLs that inject malicious scripts, potentially executing in the context of users who click those links. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.1 (medium severity). There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially compromising confidentiality and integrity of user data within the affected site. The attack requires user interaction (clicking a malicious link) and does not impact system availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Simple AL Slider plugin or applying manual input sanitization and output escaping if feasible. Additionally, educating users to avoid clicking suspicious links can reduce risk. Monitor the vendor’s channels for updates or patches addressing this vulnerability.