CVE-2025-14142 is a stored cross-site scripting vulnerability in the Electric Enquiries plugin for WordPress, affecting all versions up to 1.1. The vulnerability exists because the plugin does not properly sanitize or escape the 'button' parameter in the electric-enquiry shortcode, allowing authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code. This code executes in the context of any user who views the injected page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who visit the compromised pages, potentially exposing sensitive information or enabling further attacks. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Electric Enquiries plugin if feasible to reduce exposure.