CVE-2025-14143 is a stored cross-site scripting vulnerability in the Ayo Shortcodes WordPress plugin (versions up to 0.2). It allows authenticated users with Contributor or higher privileges to inject arbitrary web scripts via the 'color' parameter of the ayo_action shortcode. The root cause is improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of this parameter. This can lead to script execution in the context of users viewing the injected pages, potentially compromising confidentiality and integrity of user sessions.

Successful exploitation allows an authenticated user with Contributor-level or higher privileges to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability does not impact availability. The CVSS score of 6.4 reflects a medium severity with low attack complexity and no user interaction required beyond authentication.

No official patch or remediation is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates and apply any forthcoming fixes promptly. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Ayo Shortcodes plugin if feasible to mitigate risk.